CVE-2019-15052

EUVD-2019-6138
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
gradlegradle
𝑥
< 5.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gradle
bookworm
ignored
bullseye
no-dsa
buster
no-dsa
jessie
postponed
sid
vulnerable
stretch
no-dsa
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gradle
bionic
needed
disco
ignored
eoan
ignored
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needed
trusty
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/gradle/gradle/issues/10278
https://github.com/gradle/gradle/pull/10176
https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
https://github.com/gradle/gradle/issues/10278
https://github.com/gradle/gradle/pull/10176
https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95