GHSA-gpch-h32j-gx6x

    Dashboard / Vulnerabilities / GHSA-gpch-h32j-gx6x

    GHSA-gpch-h32j-gx6x

    Published: 10 Feb 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2020-5404

    Summary: Insufficiently Protected Credentials in Reactor Netty

    Details: The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-5404, https://pivotal.io/security/cve-2020-5404

    Affected packages

    Package

    Name: io.projectreactor.netty:reactor-netty-http

    Purl: pkg:maven/io.projectreactor.netty/reactor-netty-http

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0.9.0
    Fixed -0.9.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gpch-h32j-gx6x | CVE-DB