Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Gradle Subscribe
Filtered by product Plugin Publishing
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-7599 1 Gradle 1 Plugin Publishing 2020-04-02 3.3 LOW 6.5 MEDIUM
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.