1 matches found
http4k: `DigestAuthProvider.verify` did not bind to request URI
Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...
5.4AI score
SaveExploits0References4Affected Software1
20