CVE-2016-5597
OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 18, 2016
Updated · June 28, 2026
Description
A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 · 2.6AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-319 · Cleartext Transmission of Sensitive Information