Description
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Eclipse Foundation Eclipse Jetty
Default version status: unaffected
12.1.0 to ≤ 12.1.12affected12.0.0 to ≤ 12.0.38affected11.0.0 to ≤ 11.0.32affected10.0.0 to ≤ 10.0.32affected9.4.0 to ≤ 9.4.64affected