CVE-2022-27225

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safari versions, Keycloak sets a duplicate of the cookie without the Secure attribute, which allows the cookie to be sent when accessing the location that cookie is set for via HTTP. This creates the potential for an attacker (with the ability to impersonate the Gradle Enterprise host) to capture the login session of a user by having them click an http:// link to the server, despite the real server requiring HTTPS.

Gradle Enterprise versiones anteriores a 2021.4.3, es basado en la transmisión de datos en texto sin cifrar en algunas situaciones. Usa Keycloak para los servicios de administración de la identidad. Durante el proceso de inicio de sesión, Keycloak establece cookies del navegador que proporcionan efectivamente la funcionalidad "remember-me". Para la compatibilidad con versiones anteriores de Safari, Keycloak establece un duplicado de la cookie sin el atributo Secure, lo que permite que la cookie sea enviada cuando es accedida a la ubicación para la que sea establecida la cookie por medio de HTTP. Esto crea la posibilidad de que un atacante (con la capacidad de hacerse pasar por el host de Gradle Enterprise) capture la sesión de inicio de sesión de un usuario haciendo que haga clic en un enlace http:// al servidor, a pesar de que el servidor real requiere HTTPS

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-03-16 CVE Reserved
2022-03-16 CVE Published
2023-10-06 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-311: Missing Encryption of Sensitive Data

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.gradle.com/advisory/2022-03	2022-03-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gradle Search vendor "Gradle"		Enterprise Search vendor "Gradle" for product "Enterprise"				>= 2020.1 < 2021.4.3 Search vendor "Gradle" for product "Enterprise" and version " >= 2020.1 < 2021.4.3"		-		Affected