PT-2019-12287 · Gradle · Gradle Enterprise

Published 2019-04-21 · Updated 2023-01-20 · CVE-2019-11402

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2018.5.3

Description The issue concerns the storage of credentials in Build Cache Nodes. In Gradle Enterprise, these nodes did not store credentials at rest in an encrypted format.

Recommendations For versions prior to 2018.5.3, update to version 2018.5.3 or later to ensure credentials are stored in an encrypted format at rest.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-11402

Affected Products

Gradle Enterprise

References · 5

• https://gradle.com/enterprise/releases/2018.5/#changes-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11402 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11402 · Vendor Advisory
• https://security.gradle.com/advisory/CVE-2019-11402 · Note
• https://t.me/cvenotify/42548 · Telegram Post