CVE-2020-5404 MEDIUM

CVE-2020-5404: Authentication Leak On Redirect With Reactor Netty HttpClient

Vendor Pivotal
Product Reactor Netty
Weakness CWE-522 · Insufficiently protected credentials
Published March 3, 2020
Last update September 17, 2024

CVSS base score

6.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

Key dates

02Disclosure timeline

March 3, 2020 CVE published
September 17, 2024 Record updated