high7.5
CVE-2019-17598
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23.
Impact
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightbend | Play Framework | from 2.5.0 through 2.5.19 from 2.6.0 through 2.6.23 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.playframework.com/security/vulnerability
- https://www.playframework.com/security/vulnerability/CVE-2019-17598-PlayWSHttpConnectAuthorizationHeaders
- https://www.playframework.com/security/vulnerability
- https://www.playframework.com/security/vulnerability/CVE-2019-17598-PlayWSHttpConnectAuthorizationHeaders