CVE-2019-11284: Reactor Netty authentication leak in redirects
First published: Thu Oct 17 2019(Updated: )
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Credit: security@pivotal.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Reactor Netty | >=0.8.0<0.8.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11284?
CVE-2019-11284 is a vulnerability in Pivotal Reactor Netty versions prior to 0.8.11 that allows a remote unauthenticated malicious user to gain access to credentials for a different server.
How does CVE-2019-11284 affect Pivotal Reactor Netty?
CVE-2019-11284 affects Pivotal Reactor Netty versions prior to 0.8.11 by passing headers, including authorization ones, through redirects.
What is the severity of CVE-2019-11284?
The severity of CVE-2019-11284 is high with a CVSS score of 8.6.
How can a remote malicious user exploit CVE-2019-11284?
A remote unauthenticated malicious user can exploit CVE-2019-11284 by redirecting headers, including authorization ones, and gaining access to credentials for a different server.
What is the recommended solution to fix CVE-2019-11284?
To fix CVE-2019-11284, it is recommended to upgrade Pivotal Reactor Netty to version 0.8.11 or later.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/title
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/pivotal
- canonical/pivotal reactor netty
- version/pivotal reactor netty/0.8.0