CVE-2019-15052
The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials...
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
CVE-2019-15052- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2019-6138
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
EUVD-2019-6138- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xx6j-wqj7-mrv3
The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials...
The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
GHSA-xx6j-wqj7-mrv3- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
CVE-2019-15052- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSV
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
CVE-2019-15052- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15052
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
DEBIAN-CVE-2019-15052- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15052
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
- Record
UBUNTU-CVE-2019-15052- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2024:1119-1 No score
Security update for gradle, gradle-bootstrap
This update for gradle, gradle-bootstrap fixes the following issues:
- CVE-2021-29429: Fixed information disclosure through temporary directory permissions (bsc#1184799).
- CVE-2019-15052: Fixed authentication credentials disclosure (bsc#1145903).
gradle:
- Fixed RPM package building issues due to changed dependencies
gradle-bootstrap:
- Added missing dependency of aopalliance
- Record
SUSE-SU-2024:1119-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gradleDebian:12 |
All versions, plus listed versions 4.4.1-184.4.1-194.4.1-204.4.1-214.4.1-224.4.1-23 |
None known |
gradleDebian:13 |
All versions, plus listed versions 4.4.1-224.4.1-23 |
None known |
gradleDebian:14 |
All versions, plus listed versions 4.4.1-224.4.1-23 |
None known |
gradleSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gradleSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradleopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.15.1 | 4.4.1-150200.3.15.1 |
gradle-bootstrapopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 4.4.1-150200.3.9.1 | 4.4.1-150200.3.9.1 |
gradleUbuntu:16.04:LTS |
All versions, plus listed versions 2.5-32.7-12.7-22.7-32.10-1 |
None known |
gradleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.2.1-3build23.2.1-43.2.1-53.4.1-43.4.1-63.4.1-7ubuntu14.4.1-5ubuntu2~18.044.4.1-5ubuntu2~18.04+esm1 |
None known |
gradleUbuntu:20.04:LTS |
All versions, plus listed versions 4.4.1-84.4.1-94.4.1-10 |
None known |
gradleUbuntu:22.04:LTS |
All versions, plus listed versions 4.4.1-13 |
None known |
gradleUbuntu:24.04:LTS |
All versions, plus listed versions 4.4.1-184.4.1-20 |
None known |
gradleUbuntu:25.10 |
All versions, plus listed versions 4.4.1-22 |
None known |
gradleUbuntu:26.10 |
All versions, plus listed versions 4.4.1-22ubuntu14.4.1-23 |
None known |
gradleUbuntu:26.04:LTS |
All versions, plus listed versions 4.4.1-224.4.1-22build14.4.1-22ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15052 is a critical vulnerability (CVSS 9.8) in Gradle, published August 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.93%, the 87th percentile. No source names a fixed version.