CVE-2020-15772

MEDIUM

Gradle Enterprise 2018.5-2020.2.4 - XML External Entity Injection via SAML Metadata Upload

Title source: llm
STIX 2.1

Description

An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/gradle/gradle/security/advisories
Vendor Advisory x_refsource_confirm
https://security.gradle.com/advisory/CVE-2020-15772

Scores

CVSS v3 4.9
EPSS 0.0125
EPSS Percentile 65.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-611 CWE-918
Status published
Products (1)
gradle/enterprise 2018.5 - 2020.2.4
Published Sep 18, 2020
Tracked Since Feb 18, 2026