PT-2020-14620 · Gradle · Gradle Enterprise

Published 2020-09-18 · Updated 2020-09-25 · CVE-2020-15773

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2020.2.4

Description An issue allows an attacker to access data as a user after previously explicitly authenticating with the API, due to unrestricted cross-origin requests to read-only data in the Export API. This can occur for the duration of the browser session.

Recommendations For versions prior to 2020.2.4, update to version 2020.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Export API to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2020-15773

Affected Products

Gradle Enterprise

References · 4

• https://security.gradle.com/advisory/CVE-2020-15773 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15773 · Security Note
• https://github.com/gradle/gradle/security/advisories · Note