CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 0CVE-2021-41619
https://notcve.org/view.php?id=CVE-2021-41619
27 Oct 2021 — An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the applicat... • https://security.gradle.com • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41590
https://notcve.org/view.php?id=CVE-2021-41590
27 Oct 2021 — In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify the listening TCP ports available to the server, revealing information about the internal network environment. En Gradle Enterprise versiones hasta 2021.3, el sondeo del entorno de red del lado del servidor puede ocur... • https://security.gradle.com •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26719
https://notcve.org/view.php?id=CVE-2021-26719
09 Feb 2021 — A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations. Se detectó un problema de salto de directorio en Gradle gradle-enterprise-test-distribution-agent versiones anteriores a 1.3.2, test... • https://security.gradle.com/advisory/CVE-2021-26719 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 71EXPL: 0CVE-2020-11979 – ant: insecure temporary file
https://notcve.org/view.php?id=CVE-2020-11979
01 Oct 2020 — As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. Como mitigación para CVE-2020-1945, Apache Ant versión 1.10.8, cambió los permisos de los archivos temporales que creó ... • https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm • CWE-377: Insecure Temporary File CWE-379: Creation of Temporary File in Directory with Insecure Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15773
https://notcve.org/view.php?id=CVE-2020-15773
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user (for the duration of the browser session) after previously explicitly authenticating with the API. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.4. Debido a unas peticiones de origen cruzado no restringidas para datos de solo lectura en la API Export, un atacante puede acceder a los datos como u... • https://github.com/gradle/gradle/security/advisories • CWE-346: Origin Validation Error •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15767
https://notcve.org/view.php?id=CVE-2020-15767
18 Sep 2020 — An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF. Se detectó un problema en Gradle Enterprise versiones anteriores a 2020.2.5. La cookie utilizada para transmitir el token de prevenc... • https://github.com/gradle/gradle/security/advisories • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15770
https://notcve.org/view.php?id=CVE-2020-15770
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins. Se detectó un problema en Gradle Enterprise versión 2018.5. Un atacante puede hacer repetidos intentos de adivinar la contraseña de un usuario local, debido a la falta de bloqueo después de excesivos inicios de sesión fallidos • https://github.com/gradle/gradle/security/advisories • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15771
https://notcve.org/view.php?id=CVE-2020-15771
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation. Se detectó un problema en Gradle Enterprise versiones 2018.2 y en Gradle Enterprise Build Cache Node versión 4.1. La transmisión cruzada de una cookie que contiene un token CSRF permite al atacante remoto evitar la mitigación de CSRF • https://github.com/gradle/gradle/security/advisories • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15772
https://notcve.org/view.php?id=CVE-2020-15772
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Al configurar Gradle Enterprise para integrarse con un proveed... • https://github.com/gradle/gradle/security/advisories • CWE-611: Improper Restriction of XML External Entity Reference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15774
https://notcve.org/view.php?id=CVE-2020-15774
18 Sep 2020 — An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user. Se detectó un problema en Gradle Enterprise versiones 2018.5 - 2020.2.4. Un atacante con acceso físico al navegador de un usuario que se ha conectado recientemente a Gradle Enterprise y que desde entonces ha cerrado su navegador podría reabri... • https://github.com/gradle/gradle/security/advisories • CWE-613: Insufficient Session Expiration •