critical9.8
CVE-2019-15052
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.
Impact
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gradle | Gradle | before 5.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/gradle/gradle/issues/10278
- https://github.com/gradle/gradle/pull/10176
- https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
- https://github.com/gradle/gradle/issues/10278
- https://github.com/gradle/gradle/pull/10176
- https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95