PT-2020-14622 · Gradle · Gradle Enterprise

Published 2020-09-18 · Updated 2022-09-30 · CVE-2020-15775

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions 2017.1 through 2020.2.4

Description An issue was discovered where the /usage page of Gradle Enterprise conveys high-level build information, such as project names and build counts over time, and this page is incorrectly viewable anonymously.

Recommendations For Gradle Enterprise versions 2017.1 through 2020.2.4, restrict access to the /usage page to prevent anonymous viewing.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2020-15775

Affected Products

Gradle Enterprise

References · 4

• https://security.gradle.com/advisory/CVE-2020-15775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15775 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15775 · Vendor Advisory
• https://github.com/gradle/gradle/security/advisories · Note