Description (CNA)
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Reactor Netty | affected 1.3.0 through 1.3.6; affected 1.1.0 through 1.2.18; affected 0 through 1.0.52 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.