CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49238
https://notcve.org/view.php?id=CVE-2023-49238
09 Jan 2024 — In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in. En Gradle Enterprise anterior a 2023.1, un atacante remoto podría obtener acceso a una nueva instalación (en ciertos escenarios de instalación) debido a una contraseña de us... • https://security.gradle.com • CWE-521: Weak Password Requirements •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25364
https://notcve.org/view.php?id=CVE-2022-25364
17 Mar 2022 — In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as part of a build. As of 2021.4.2, the built-in build cache is inaccessible-by-default, requiring explicit configuration of its access-control settings before it can be used. (Remote build cache nodes are unaffected as t... • https://security.gradle.com • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27225
https://notcve.org/view.php?id=CVE-2022-27225
16 Mar 2022 — Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safari versions, Keycloak sets a duplicate of the cookie without the Secure attribute, which allows the cookie to be sent when accessing the location that cookie is set for via HTTP. This creates the potential for an att... • https://security.gradle.com/advisory/2022-03 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41589
https://notcve.org/view.php?id=CVE-2021-41589
27 Oct 2021 — In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration, a malicious actor with network access can populate the cache with manipulated entries th... • https://security.gradle.com • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15773
https://notcve.org/view.php?id=CVE-2020-15773
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user (for the duration of the browser session) after previously explicitly authenticating with the API. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.4. Debido a unas peticiones de origen cruzado no restringidas para datos de solo lectura en la API Export, un atacante puede acceder a los datos como u... • https://github.com/gradle/gradle/security/advisories • CWE-346: Origin Validation Error •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15767
https://notcve.org/view.php?id=CVE-2020-15767
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.5. La cookie utilizada para transmitir el token de prevenc... • https://github.com/gradle/gradle/security/advisories • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15772
https://notcve.org/view.php?id=CVE-2020-15772
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Al configurar Gradle Enterprise para integrarse con un proveed... • https://github.com/gradle/gradle/security/advisories • CWE-611: Improper Restriction of XML External Entity Reference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15774
https://notcve.org/view.php?id=CVE-2020-15774
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Un atacante con acceso físico al navegador de un usuario que se ha conectado recientemente a Gradle Enterprise y que desde entonces ha cerrado su navegador podría reabri... • https://github.com/gradle/gradle/security/advisories • CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15775
https://notcve.org/view.php?id=CVE-2020-15775
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously. Se detectó un problema en Gradle Enterprise versiones 2017.1 - 2020.2.4. La página de uso de Gradle Enterprise transmite información de alto nivel como nombres de proyectos y recuentos de construcción a lo largo del tiempo. • https://github.com/gradle/gradle/security/advisories • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15776
https://notcve.org/view.php?id=CVE-2020-15776
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to perform cross-site request forgery. Se detecto un problema en el Gradle Enterprise versiones 2018.2 - 2020.2.4. El token de prevención del CSRF se almacena en una cookie de petición que no está anotada como HttpOnly. • https://cwe.mitre.org/data/definitions/1004.html • CWE-732: Incorrect Permission Assignment for Critical Resource •