Read the docs
TI-2020-12412 Aliases CVE-2020-15777GHSA-vp55-fhxx-vcx8

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise.

Priority LOW 36CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.

Why it matters now

EPSS 0.01047 64th percentileScored 2026-11-07
Fix Fixed com.gradle:gradle-enterprise-maven-extension (Maven): 1.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.gradle:gradle-enterprise-maven-extension (Maven)before 1.61.6Patch availableGHSA-vp55-fhxx-vcx8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.gradle:gradle-enterprise-maven-extension (Maven) Vendor— Affected before 1.6 Fixed in 1.6 Patch available GHSA-vp55-fhxx-vcx8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gradle:maven:*:*:*:*:*:gradle:*:*before 1.6Vulnerablegradle
  • cpe:2.3:a:gradle:maven:*:*:*:*:*:gradle:*:* Versions before 1.6 Vulnerable ·gradle

Remediation

  • Fix · GHSA-vp55-fhxx-vcx8 com.gradle:gradle-enterprise-maven-extension (Maven) Fixed in 1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15777
  2. 2026-10-03 Alias added: GHSA-vp55-fhxx-vcx8

References

Advisory 3

Other 1

  • TI-2021-08398 A directory traversal issue was discovered in Gradle… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences