CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26719
https://notcve.org/view.php?id=CVE-2021-26719
09 Feb 2021 — A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations. Se detectó un problema de salto de directorio en Gradle gradle-enterprise-test-distribution-agent versiones anteriores a 1.3.2, test... • https://security.gradle.com/advisory/CVE-2021-26719 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 0CVE-2020-11979 – ant: insecure temporary file
https://notcve.org/view.php?id=CVE-2020-11979
01 Oct 2020 — As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. Como mitigación para CVE-2020-1945, Apache Ant versión 1.10.8, cambió los permisos de los archivos temporales que creó ... • https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm • CWE-377: Insecure Temporary File CWE-379: Creation of Temporary File in Directory with Insecure Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15773
https://notcve.org/view.php?id=CVE-2020-15773
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user (for the duration of the browser session) after previously explicitly authenticating with the API. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.4. Debido a unas peticiones de origen cruzado no restringidas para datos de solo lectura en la API Export, un atacante puede acceder a los datos como u... • https://github.com/gradle/gradle/security/advisories • CWE-346: Origin Validation Error •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15767
https://notcve.org/view.php?id=CVE-2020-15767
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.5. La cookie utilizada para transmitir el token de prevenc... • https://github.com/gradle/gradle/security/advisories • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15770
https://notcve.org/view.php?id=CVE-2020-15770
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins. Se detectó un problema en Gradle Enterprise versión 2018.5. Un atacante puede hacer repetidos intentos de adivinar la contraseña de un usuario local, debido a la falta de bloqueo después de excesivos inicios de sesión fallidos • https://github.com/gradle/gradle/security/advisories • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15771
https://notcve.org/view.php?id=CVE-2020-15771
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation. Se detectó un problema en Gradle Enterprise versiones 2018.2 y en Gradle Enterprise Build Cache Node versión 4.1. La transmisión cruzada de una cookie que contiene un token CSRF permite al atacante remoto evitar la mitigación de CSRF • https://github.com/gradle/gradle/security/advisories • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15772
https://notcve.org/view.php?id=CVE-2020-15772
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Al configurar Gradle Enterprise para integrarse con un proveed... • https://github.com/gradle/gradle/security/advisories • CWE-611: Improper Restriction of XML External Entity Reference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15774
https://notcve.org/view.php?id=CVE-2020-15774
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Un atacante con acceso físico al navegador de un usuario que se ha conectado recientemente a Gradle Enterprise y que desde entonces ha cerrado su navegador podría reabri... • https://github.com/gradle/gradle/security/advisories • CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15775
https://notcve.org/view.php?id=CVE-2020-15775
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously. Se detectó un problema en Gradle Enterprise versiones 2017.1 - 2020.2.4. La página de uso de Gradle Enterprise transmite información de alto nivel como nombres de proyectos y recuentos de construcción a lo largo del tiempo. • https://github.com/gradle/gradle/security/advisories • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15776
https://notcve.org/view.php?id=CVE-2020-15776
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to perform cross-site request forgery. Se detecto un problema en el Gradle Enterprise versiones 2018.2 - 2020.2.4. El token de prevención del CSRF se almacena en una cookie de petición que no está anotada como HttpOnly. • https://cwe.mitre.org/data/definitions/1004.html • CWE-732: Incorrect Permission Assignment for Critical Resource •