CVE-2019-11284 — Reactor Netty authentication leak in redirects

CVE-2019-11284

Reactor Netty authentication leak in redirects PUBLISHED

Description (CNA)

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

Affected (CNA)

Vendor / product	Versions
Pivotal / Reactor Netty	affected prior to v0.8.11.RELEASE

CWE

CWE-522

References

https://pivotal.io/security/cve-2019-11284

ADP enrichment

CVE

No English description supplied.

https://pivotal.io/security/cve-2019-11284