CVE-2019-15052
9.8
CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 87)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.93% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-522 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-08-14 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| gradle | gradle |
References
- https://github.com/gradle/gradle/issues/10278
- https://github.com/gradle/gradle/pull/10176
- https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
- https://github.com/gradle/gradle/issues/10278
- https://github.com/gradle/gradle/pull/10176
- https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
→ the Explorer · watch your stack · NVD