CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41575
https://notcve.org/view.php?id=CVE-2022-41575
21 Oct 2022 — A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3. Una vulnerabilidad de exposición de credenciales en el mecanismo de support-bundle en Gradle Enterprise versiones 2022.3 hasta 2022.3.3, permite a atacantes remotos acceder a un subconjunto de datos de la aplicación (por ejemplo, credenciales en texto sin cifrar). Esto ha sido ... • https://security.gradle.com • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41574
https://notcve.org/view.php?id=CVE-2022-41574
07 Oct 2022 — An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2. Una vulnerabilidad de control de acceso en Gradle Enterprise versiones 2022.4 hasta 2022.3.1 permite a atacantes remotos evitar que sean realizadas copias de seguridad y enviar corr... • https://security.gradle.com • CWE-863: Incorrect Authorization •
CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31156 – Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed
https://notcve.org/view.php?id=CVE-2022-31156
14 Jul 2022 — Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains ... • https://docs.gradle.org/7.5/release-notes.html • CWE-347: Improper Verification of Cryptographic Signature CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30587
https://notcve.org/view.php?id=CVE-2022-30587
06 Jun 2022 — Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure. Gradle Enterprise versiones hasta 2022.2.2 , presenta un Control de Acceso Incorrecto que conlleva a una divulgación de información • https://security.gradle.com • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 0CVE-2022-30586
https://notcve.org/view.php?id=CVE-2022-30586
06 Jun 2022 — Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. Gradle Enterprise versiones hasta 2022.2.2, presenta un Control de Acceso Incorrecto que conlleva a una ejecución de código • https://security.gradle.com • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2022-27919
https://notcve.org/view.php?id=CVE-2022-27919
25 Mar 2022 — Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API. Gradle Enterprise versiones anteriores a 2022.1, permite una ejecución de código remota si el proceso de instalación no especificó un archivo de configuración inicial. La configuración permite determinados accesos anónimos a la administración y a una API • https://security.gradle.com/advisory/2022-05 • CWE-276: Incorrect Default Permissions •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25364
https://notcve.org/view.php?id=CVE-2022-25364
17 Mar 2022 — In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as part of a build. As of 2021.4.2, the built-in build cache is inaccessible-by-default, requiring explicit configuration of its access-control settings before it can be used. (Remote build cache nodes are unaffected as t... • https://security.gradle.com • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27225
https://notcve.org/view.php?id=CVE-2022-27225
16 Mar 2022 — Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safari versions, Keycloak sets a duplicate of the cookie without the Secure attribute, which allows the cookie to be sent when accessing the location that cookie is set for via HTTP. This creates the potential for an att... • https://security.gradle.com/advisory/2022-03 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23630 – Dependency verification bypass in Gradle
https://notcve.org/view.php?id=CVE-2022-23630
10 Feb 2022 — Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is ... • https://docs.gradle.org/7.4/release-notes.html • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2021-41589
https://notcve.org/view.php?id=CVE-2021-41589
27 Oct 2021 — In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration, a malicious actor with network access can populate the cache with manipulated entries th... • https://security.gradle.com • CWE-732: Incorrect Permission Assignment for Critical Resource •