{"id":"CVE-2020-15767","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-15767","generatedAt":"2026-10-27T23:29:50.861Z","title":"The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access…","description":"An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF.","published":"2020-09-18T14:15:12.000Z","lastModified":"2026-06-17T02:57:09.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-311"],"affected":["gradle/enterprise"],"epss":{"score":0.00542,"percentile":0.45278,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.54%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/gradle/gradle/security/advisories","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://security.gradle.com/advisory/CVE-2020-15767","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/gradle/gradle/security/advisories","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gradle.com/advisory/CVE-2020-15767","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-15767","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}