Priority MEDIUM 50
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00774 · Published 2024-01-09 · No fix listed CWE-521
Priority MEDIUM 47
In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node with its default configuration.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02384 · Published 2021-10-27 · No fix listed CWE-732
Priority MEDIUM 46
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01841 · Published 2022-03-25 · No fix listed CWE-276
Priority MEDIUM 45
In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01332 · Published 2019-04-21 · No fix listed CWE-522
Priority MEDIUM 44
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01176 · Published 2019-04-21 · No fix listed CWE-200
Priority MEDIUM 42
An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02048 · Published 2020-09-18 · No fix listed CWE-732
Priority MEDIUM 41
A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00916 · Published 2022-10-21 · No fix listed CWE-522
Priority LOW 37
In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01017 · Published 2022-03-17 · No fix listed CWE-276
Priority LOW 37
An issue was discovered in Gradle Enterprise before 2021.1.2.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02722 · Published 2021-10-27 · No fix listed CWE-94
Priority LOW 36
An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01677 · Published 2020-09-18 · No fix listed
Priority LOW 35
An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01217 · Published 2020-09-18 · No fix listed CWE-922
Priority LOW 35
An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01036 · Published 2020-09-18 · No fix listed CWE-311
Priority LOW 34
An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administr…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00778 · Published 2022-10-07 · No fix listed CWE-863
Priority LOW 30
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0054 · Published 2022-03-16 · No fix listed CWE-311
Priority LOW 30
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00343 · Published 2020-09-18 · No fix listed CWE-613
Priority LOW 29
An issue was discovered in Gradle Enterprise before 2020.2.4.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00422 · Published 2020-09-18 · No fix listed CWE-346
Priority LOW 28
An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00655 · Published 2020-09-18 · No fix listed CWE-79
Priority LOW 25
In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00801 · Published 2021-10-27 · No fix listed
Priority LOW 25
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01248 · Published 2020-09-18 · No fix listed CWE-611
Priority LOW 25
An issue was discovered in Gradle Enterprise before 2020.2.5.
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00542 · Published 2020-09-18 · No fix listed CWE-311
Priority LOW 24
An issue was discovered in Gradle Enterprise 2018.5.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00266 · Published 2020-09-18 · No fix listed CWE-307
THREATIST.IORead the docs