Gradle Technologies is now Develocity — read the announcement

← All advisories

SAML IDP metadata XML upload is vulnerable to server-side request forgery via XXE injection

Affected product(s)
  • Gradle Enterprise 2018.5 - 2020.2.4
Severity
Moderate
Published
September 15, 2020
Related CVE ID(s)

Description

When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator.

The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery.

Mitigation

Upgrade to Gradle Enterprise 2020.2.5.

Credit

This issue was responsibly reported by Compass Security.

© 2026 Gradle, Inc. Gradle®, Develocity®, Build Scan®, and the Gradlephant logo are registered trademarks of Gradle, Inc.

Get an AI summary of Develocity: