CVE-2019-15052
9.8 · CRITICALThe HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.
Overview
CVE-2019-15052 is a critical-severity vulnerability. It was published on August 14, 2019 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Remediation
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2019-15052?
CVE-2019-15052 is a critical-severity vulnerability. It was published on August 14, 2019 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2019-15052?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2019-15052?
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2019-15052?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2019-15052 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2019
View all- 10.0CVE-2018-14721
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side requ
View details - 10.0CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
View details - 10.0CVE-2019-0020
Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker
View details - 10.0CVE-2019-0022
Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker t
View details - 10.0CVE-2015-9280
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
View details - 10.0CVE-2018-5560
A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Pra
View details - 10.0CVE-2018-18505
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authenti
View details - 10.0CVE-2018-3991
An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network s
View details - 10.0CVE-2019-6235
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3,
View details - 10.0CVE-2018-18815
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Serv
View details - 10.0CVE-2019-7609
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion vis
View details - 10.0CVE-2019-10686
An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may
View details