CRITICAL🇵🇱 Wersja polska

CVE-2019-15052

CVSS 9.8v3.1pub. 2019-08-14upd. 2024-11-21

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Gradle

    APP
    Gradle
    < 5.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2016-6199CRITICAL9.8ten sam produkt

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serial...

CVE-2026-22816HIGH8.6ten sam produkt

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When r...

CVE-2026-22865HIGH8.6ten sam produkt

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When r...

CVE-2022-30586HIGH7.2ten sam produkt

Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.

CVE-2022-23630HIGH7.5ten sam produkt

Gradle is a build tool with a focus on build automation and support for multi-language development. In some ca...