CVE-2020-15777

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

com.gradle:common-custom-user-data-maven-extension (>=1.0, <=1.1.1) potentially affected by CVE-2020-15777 via com.gradle:gradle-enterprise-maven-extension (>=1.4.1, <=1.5.1)

com.gradle:gradle-enterprise-maven-extension MAVEN version =1.4.1, =1.0, =1.1.1 Source cves: CVE-2020-15777 Source advisory: GHSA-VP55-FHXX-VCX8...

com.gradle:common-custom-user-data-maven-extension (>=1.0, <=1.1.1) potentially affected by CVE-2020-15777 via com.gradle:gradle-enterprise-maven-extension (>=1.4.1, <=1.5.1)

com.gradle:gradle-enterprise-maven-extension MAVEN version =1.4.1, =1.0, =1.1.1 Source cves: CVE-2020-15777 Source advisory: OSV:GHSA-VP55-FHXX-VCX8...

CVE-2020-15777

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization...

CVE-2020-15777

The CVE-2020-15777 issue affects the Maven Extension plugin for Gradle Enterprise prior to version 1.6. The plugin uses a socket connection to send serialized Java objects and deserialization is not restricted to an allow-list, enabling code execution via a malicious deserialization gadget chain....