CVE-2019-15052 Information disclosure in n/a
Gradle leaks authentication credentials to unintended hosts when HTTP requests are redirected, exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15052?
CVE-2019-15052 is a critical vulnerability in n/a, published on 14 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Weakness: CWE-522
Which versions are affected by CVE-2019-15052?
It affects 1 product.
Products include Gradle Gradle.
How do I fix CVE-2019-15052?
Upgrade to a fixed version.
Is CVE-2019-15052 being exploited?
There is no known exploitation of CVE-2019-15052 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
- CVE-2021-41588 Deserialization in n/a
Sources
Also known as DEBIAN-CVE-2019-15052, GHSA-4cwg-f7qc-6r95, GHSA-xx6j-wqj7-mrv3, UBUNTU-CVE-2019-15052.