CVE-2020-15777
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle Enterprise 1.6之前版本中存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。该漏洞允许攻击者通过恶意的反序列化小部件链来实现代码执行。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15777
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Gradle 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle Enterprise 1.6之前版本中存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。该漏洞允许攻击者通过恶意的反序列化小部件链来实现代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2020-15777
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15777
请登录查看更多情报信息。
Other References for CVE-2020-15777 (2)
-
https://security.gradle.com/advisory/CVE-2020-15777 x_refsource_CONFIRM
-
https://docs.gradle.com/enterprise/maven-extension/#1_6 x_refsource_CONFIRM
Same Patch Batch · n/a · 2020-08-25 · 13 CVEs total
| CVE-2019-14904 | Ansible solaris_zone模块操作系统命令注入漏洞 | |
| CVE-2020-19005 | zrlog 安全漏洞 | |
| CVE-2020-16197 | Octopus Deploy 信任管理问题漏洞 | |
| CVE-2020-24622 | Sonatype Nexus Repository 信息泄露漏洞 | |
| CVE-2020-16245 | Advantech iView 路径遍历漏洞 | |
| CVE-2020-24616 | FasterXML jackson-databind 代码问题漏洞 | |
| CVE-2020-14042 | Codiad 跨站脚本漏洞 | |
| CVE-2020-24609 | Savsoft Quiz 5 跨站脚本漏洞 | |
| CVE-2020-24242 | Netwide Assembler 安全漏洞 | |
| CVE-2020-24241 | Netwide Assembler 资源管理错误漏洞 | |
| CVE-2020-24240 | GNU Bison 资源管理错误漏洞 | |
| CVE-2020-24614 | Fossil 代码注入漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2020-15777
No comments yet