Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH Severity: CVE-2019-11284 (CVSS 8.6) Pivotal Reactor Netty <0.8.11 leaks authorization headers through redirects. Unauthenticated attackers can steal credentials for unintended servers. Upgrade immediately. #CVE #PatchNow #ThreatIntel https://t.co/tOIgLwj124
Post summary
The tweet announces CVE-2019-11284, details how Reactor Netty leaks auth headers and can steal credentials, and urges an immediate patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | broadcom | reactor_netty | - | - | - |