CVE-2020-5404: Insufficiently Protected Credentials

February 10, 2022

The HttpClient from Reactor Netty,, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

References

github.com/advisories/GHSA-gpch-h32j-gx6x
nvd.nist.gov/vuln/detail/CVE-2020-5404
pivotal.io/security/cve-2020-5404

Code Behaviors & Features

Detect and mitigate CVE-2020-5404 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →