CVEvulnerability
CVE-2020-15767
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-311
Description
An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF.
Affected configurations
• gradle enterprise (< 2020.2.5)
Related
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- https://github.com/gradle/gradle/security/advisories Third Party Advisory
- https://security.gradle.com/advisory/CVE-2020-15767 Vendor Advisory
- https://github.com/gradle/gradle/security/advisories Third Party Advisory
- https://security.gradle.com/advisory/CVE-2020-15767 Vendor Advisory