CVE-2020-11021

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-110226.1In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM man CVE-2020-110236.1In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even CVE-2020-110248.2In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.CVE-2020-110255.4In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code CVE-2020-110265.4In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon CVE-2020-110278.1In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be CVE-2020-110287.5In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif CVE-2020-110296.1In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site CVE-2020-11036.5An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to c CVE-2020-110305.4In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the CVE-2020-110317.5In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if CVE-2020-110327.2In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a te