PT-2019-12288 · Gradle · Gradle Enterprise

Published 2019-04-21 · Updated 2023-01-20 · CVE-2019-11403

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2018.5.2

Description The issue allows the configured password to be reflected back when viewing the HTML page source of the settings page in Build Cache Nodes.

Recommendations For versions prior to 2018.5.2, update to version 2018.5.2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-11403

Affected Products

Gradle Enterprise

References · 5

• https://security.gradle.com/advisory/CVE-2019-11403 · Vendor Advisory
• https://gradle.com/enterprise/releases/2018.5/#changes-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11403 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11403 · Vendor Advisory
• https://t.me/cvenotify/42549 · Telegram Post