Headline
CVE-2020-15767: Gradle Enterprise - Security Advisories
An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF.
All advisoriesCSRF prevention cookie is susceptible to capture by MITM on HTTP redirect
Affected product(s)
- Gradle Enterprise < 2020.2.5
Severity
Moderate
Published at
2020-09-15
Related CVE ID(s)
- CVE-2020-15767
Description
The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server.
This cookie value could then be used to perform CSRF.
Mitigation
Upgrade to Gradle Enterprise 2020.2.5.
Credit
This issue was responsibly reported by Compass Security.