1 matches found
http4k: `DigestAuthProvider.verify` did not bind to request URI
Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...
8.1CVSS5.4AI score0.0058EPSS
SaveExploits0References7Affected Software1
20