PT-2020-14618 · Gradle · Gradle Enterprise Build Cache Node+1

Published 2020-09-18 · Updated 2021-12-21 · CVE-2020-15771

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise version 2018.2 Gradle Enterprise Build Cache Node version 4.1

Description An issue allows a remote attacker to bypass CSRF mitigation due to cross-site transmission of a cookie containing a CSRF token.

Recommendations For Gradle Enterprise version 2018.2, update to a version that fixes this issue. For Gradle Enterprise Build Cache Node version 4.1, update to a version that fixes this issue.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-15771

Affected Products

Gradle Enterprise

Gradle Enterprise Build Cache Node

References · 4

• https://security.gradle.com/advisory/CVE-2020-15771 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15771 · Security Note
• https://github.com/gradle/gradle/security/advisories · Note