An issue was discovered in Gradle Enterprise before 2020.2.5. Lack of the secure attribute on the anti-CSRF cookie allows an attacker (with the ability to read HTTP traffic) to obtain a user's anti-CSRF token if the user initiates a cleartext HTTP request.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-15767
• https://github.com/gradle/gradle/security/advisories
• https://security.gradle.com/advisory/CVE-2020-15767