CVE-2020-15767
Medium
Description
An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF.
SeverityMedium
CVSS5.3
Exploit probability—
ProductGradle Enterprise
PublishedSep 18, 2020
First seenSep 18, 2020
How to fix
Update
- gradle enterprise2020.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gradle enterprise | v < 2020.2.5 | 2020.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.