CVE-2019-11284CWE-522

CVE-2019-11284

High · published October 17, 2019

CVSS v3.1
8.6
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00894 · 59.1th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2019-10-17T22:15Z
Affected products (1)
ProductVersionsFixed in
broadcom/reactor_netty≥ 0.8.0, < 0.8.110.8.11
References (2)
https://pivotal.io/security/cve-2019-11284 · [email protected]https://pivotal.io/security/cve-2019-11284 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 OCT 17:40Z
    Reactor Netty authentication leak in redirects
    cvelistv5