CVE-2021-41619
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the application.
Se ha detectado un problema en Gradle Enterprise versiones anteriores a 2021.1.2. Se presenta una potencial ejecución de código remota por medio de la configuración de inicio de la aplicación. La interfaz de usuario de configuración de la instalación (disponible para los administradores) permite especificar opciones de inicio de la máquina virtual Java arbitrarias. Algunas de estas opciones, como -XX:OnOutOfMemoryError, permiten especificar un comando a ejecutar en el host. Esto puede ser abusado para ejecutar comandos arbitrarios en el host, si un atacante consigue acceso administrativo a la aplicación
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-09-27 CVE Reserved
- 2021-10-27 CVE Published
- 2024-01-19 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://security.gradle.com | 2021-11-03 | |
https://security.gradle.com/advisory/2021-08 | 2021-11-03 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Gradle Search vendor "Gradle" | Enterprise Search vendor "Gradle" for product "Enterprise" | >= 2020.4 < 2021.1.2 Search vendor "Gradle" for product "Enterprise" and version " >= 2020.4 < 2021.1.2" | - |
Affected
|