{"id":"CVE-2019-15052","details":"The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.","aliases":["GHSA-4cwg-f7qc-6r95"],"modified":"2026-07-09T00:06:21.183461Z","published":"2019-08-14T20:15:11.650Z","related":["SUSE-SU-2024:1119-1"],"references":[{"type":"REPORT","url":"https://github.com/gradle/gradle/issues/10278"},{"type":"FIX","url":"https://github.com/gradle/gradle/pull/10176"},{"type":"EVIDENCE","url":"https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gradle/gradle","events":[{"introduced":"0"},{"fixed":"f0b9d60906c7b8c42cd6c61a39ae7b74767bb012"}],"database_specific":{"cpe":"cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.6"}],"source":"CPE_RANGE"}}],"versions":["v5.6.0-RC2","v5.6.0-RC1","v5.5.1","v5.5.0","v5.5.0-RC4","v5.5.0-RC3","v5.5.0-RC2","v5.5.0-RC1","v5.4.1","v5.4.0","v5.4.0-RC1","v3.0.0-M1","REL_3.0-milestone-1","v1.12.0-RC2","v1.12.0","v1.12-RC2","v1.12","REL_1.12-rc-2","REL_1.12","v1.12.0-RC1","v1.12-RC1","REL_1.12-rc-1","v1.11.0","v1.11","REL_1.11","v1.11.0-RC1","v1.11-RC1","REL_1.11-rc-1","v1.0.0-M3","v1.0-M3","REL_1.0-milestone-3","v1.0.0-M2","v1.0-M2","REL_1.0-milestone-2","v1.0.0-M1","v1.0-M1","REL_1.0-milestone-1","v0.9.2","REL_0.9.2","v0.9.1","REL_0.9.1","v0.9.0","v0.9","REL_0.9","v0.9.0-RC3","v0.9-RC3","REL_0.9-rc-3","v0.9.0-RC2","v0.9-RC2","REL_0.9-rc-2","v0.9.0-RC1","v0.9-RC1","REL-0.9-rc-1","REL-0.9-preview-3","REL-0.9-preview-2","REL-0.9-preview-1","v0.8.0","v0.8","REL-0.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15052.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}