PT-2020-14614 · Gradle · Gradle Enterprise

Published 2020-09-18 · Updated 2021-12-21 · CVE-2020-15767

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2020.2.5

Description An issue allows an attacker with the ability to perform a man-in-the-middle (MITM) attack on plain HTTP requests to obtain the CSRF prevention token cookie, if the user mistakenly uses an HTTP address instead of HTTPS to access the server. This cookie value could then be used to perform a cross-site request forgery (CSRF) attack.

Recommendations For versions prior to 2020.2.5, update to version 2020.2.5 or later to resolve the issue.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-15767

Affected Products

Gradle Enterprise

References · 4

• https://security.gradle.com/advisory/CVE-2020-15767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15767 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15767 · Vendor Advisory
• https://github.com/gradle/gradle/security/advisories · Note