CVE-2019-15052: Critical severity gradle vulnerability
Published Aug 14, 2019
·Updated
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Affected Software
1 affected component
gradle Gradle<5.6
Remediation
Patch Available
Event History
Aug 14, 2019
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionSeverity
Frequently Asked Questions
1
What is CVE-2019-15052?
CVE-2019-15052 is a vulnerability in the HTTP client of Gradle before version 5.6.
2
How severe is CVE-2019-15052?
CVE-2019-15052 is considered critical with a severity score of 9.8 out of 10.
3
What is the affected software for CVE-2019-15052?
The affected software for CVE-2019-15052 is Gradle version up to (but excluding) 5.6.
4
What is the CWE ID for CVE-2019-15052?
The CWE ID for CVE-2019-15052 is CWE-522.
5
How can I fix CVE-2019-15052?
To fix CVE-2019-15052, you should update Gradle to version 5.6 or later.