CVE-2020-5404mediumCWE-522

CVE-2020-5404: falha de média gravidade em Pivotal Reactor Netty

Authentication Leak On Redirect With Reactor Netty HttpClient

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Reactor Netty+ Monitorar io.projectreactor.netty:reactor-netty-http

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.7%
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
Pivotal · Reactor Netty
CVEs relacionadas — Pivotal Reactor Netty

No mesmo produto, das mais perigosas para as menos.

CVE-2020-5403MEDIUMDoS Via Malformed URL with Reactor Netty HTTP ServerEPSS 1.2%CVE-2019-11284MEDIUMReactor Netty authentication leak in redirectsEPSS 0.9%