PT-2020-14619 · Gradle · Gradle Enterprise

Published 2020-09-18 · Updated 2022-09-30 · CVE-2020-15772

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions 2018.5 through 2020.2.4

Description An issue allows a remote attacker with administrative access to perform server side request forgery when configuring Gradle Enterprise to integrate with a SAML identity provider. This is due to the server side processing of an uploaded XML metadata file dereferencing XML External Entities (XXE).

Recommendations For Gradle Enterprise versions 2018.5 through 2020.2.4, as a temporary workaround, consider restricting access to the XML metadata file upload feature until a patch is available. Restrict administrative access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

XXE

Weakness Enumeration

CWE-918

CWE-611

Related Identifiers

CVE-2020-15772

Affected Products

Gradle Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-15772 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15772 · Vendor Advisory
• https://security.gradle.com/advisory/CVE-2020-15772 · Vendor Advisory
• https://github.com/gradle/gradle/security/advisories · Note