Deserialization in Gradle Maven
CVE-2020-15777
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (62.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
Weakness classification (CWE)
References
- security.gradle.com/advisory/CVE-2020-15777 (Vendor Advisory)
- docs.gradle.com/enterprise/maven-extension/ (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-15777?
- CVE-2020-15777 is a high-severity vulnerability in Gradle Maven, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2020-08-25.
- How severe is CVE-2020-15777?
- High severity. CVSS v3 base score is 7.8 out of 10.