CVE-2020-15776

An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to perform cross-site request forgery.

• CWE-732

• https://cwe.mitre.org/data/definitions/1004.htmlThird Party Advisory
• https://github.com/gradle/gradle/security/advisoriesThird Party Advisory
• https://security.gradle.com/advisory/CVE-2020-15776Vendor Advisory
• https://cwe.mitre.org/data/definitions/1004.htmlThird Party Advisory
• https://github.com/gradle/gradle/security/advisoriesThird Party Advisory
• https://security.gradle.com/advisory/CVE-2020-15776Vendor Advisory

Published

Sep 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15770An issue was discovered in Gradle Enterprise 2018.5. An atta…5.5
• CVE-2020-15771An issue was discovered in Gradle Enterprise 2018.2 and Grad…7.5
• CVE-2020-15772An issue was discovered in Gradle Enterprise 2018.5 - 2020.2…4.9
• CVE-2020-15773An issue was discovered in Gradle Enterprise before 2020.2.4…6.5
• CVE-2020-15774An issue was discovered in Gradle Enterprise 2018.5 - 2020.2…6.8
• CVE-2020-15775An issue was discovered in Gradle Enterprise 2017.1 - 2020.2…7.5
• CVE-2020-15777An issue was discovered in the Maven Extension plugin before…7.8
• CVE-2020-15778scp in OpenSSH through 8.3p1 allows command injection in the…7.4
• CVE-2020-15779A Path Traversal issue was discovered in the socket.io-file …7.5
• CVE-2020-1578An information disclosure vulnerability exists in the Window…4.7
• CVE-2020-15780An issue was discovered in drivers/acpi/acpi_configfs.c in t…6.7
• CVE-2020-15781A vulnerability has been identified in SICAM WEB firmware fo…9.6