CVE-2020-15774 Auth bypass in n/a
An attacker with physical access to a user's browser can bypass authentication and access Gradle Enterprise as that user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15774?
CVE-2020-15774 is a medium-severity authentication bypass vulnerability in n/a, published on 18 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user.
Weakness: CWE-613
Which versions are affected by CVE-2020-15774?
It affects 1 product.
Products include Gradle Enterprise.
How do I fix CVE-2020-15774?
No fix has been published for CVE-2020-15774 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-15774 being exploited?
There is no known exploitation of CVE-2020-15774 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7xcg-cx52-vr25.