Description
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
Remediation
References
Related Vulnerabilities
WordPress Plugin History Collection Arbitrary File Download (1.1.1)
WordPress Plugin Quiz Maker Multiple SQL Injection Vulnerabilities (6.2.0.8)
Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2022-23498)
WordPress Plugin Visual CSS Style Editor Cross-Site Request Forgery (7.2.0)