Read the docs
TI-2023-22610 Aliases CVE-2023-42445

Possible local file exfiltration by XML External entity injection

Priority LOW 31CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00781 56th percentileScored 2026-11-07
Fix Partial gradle (gradle): 8.4, 7.6.3Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gradlegradlebefore 8.4; before 7.6.38.4, 7.6.3Patch availableCNA
  • gradle Vendorgradle Affected before 8.4; before 7.6.3 Fixed in 8.4, 7.6.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*before 7.6.3; 8.0.0 to before 8.4.0Vulnerablegradle
  • cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:* Versions before 7.6.3; 8.0.0 to before 8.4.0 Vulnerable ·gradle

Remediation

  • Fix · CNA gradle (gradle) Fixed in 8.4, 7.6.3

Red Hat 1 advisory

  • RHSA-2023:7678 Released 2023-12-06 · Red Hat rating Important
    Red Hat AMQ Streams 2.6.0 release and security update
    • Red Hat AMQ Streams 2.6.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Red Hat AMQ Streams 2.6.0Fixed RHSA-2023:7678
Not affected: 3 products
  • Red Hat Integration Camel Quarkus 2
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42445

References

Advisory 2

Other 2

  • TI-2016-05320 ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code… CVSS 3.0CRITICAL 9.8
  • TI-2020-09639 Injection in Apache Ant CVSS 3.1HIGH 7.5
  • TI-2019-11237 The HTTP client in Gradle before 5.6 sends authentication credentials originally destined… CVSS 3.1CRITICAL 9.8
  • TI-2021-12419 Arbitrary code execution via specially crafted environment variables CVSS 3.1HIGH 7.5
  • TI-2023-11286 Gradle usage of long IDs for PGP keys opens potential for collision attacks CVSS 3.1CRITICAL 9.8
  • TI-2021-10141 Local privilege escalation through system temporary directory CVSS 3.1HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences