PT-2022-20889
CVE-2022-31684
·
تاريخ النشر
2022-10-19
·
تاريخ التحديث
2022-10-21
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Reactor Netty HTTP Server versions 1.0.11 through 1.0.23
Description
The issue affects the logging of request headers in cases of invalid HTTP requests. When logging at WARN level is enabled, the logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests.
Recommendations
For Reactor Netty HTTP Server versions 1.0.11 through 1.0.23, consider disabling the logging of request headers at WARN level for invalid HTTP requests until a patch is available. Restrict access to server logs to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾