PT-2021-23351 · Gradle · Gradle Enterprise

Published 2021-09-24 · Updated 2024-03-06 · CVE-2021-41588

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2021.1.3

Description The issue allows a crafted request to trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys.

Recommendations For versions prior to 2021.1.3, update to version 2021.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the encryption and signing keys to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-GRADLE-2021-41588

CVE-2021-41588

Affected Products

Gradle Enterprise

References · 6

• https://osv.dev/vulnerability/BIT-gradle-2021-41588 · Vendor Advisory
• https://security.gradle.com/advisory/2021-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41588 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41588 · Vendor Advisory
• https://t.me/cibsecurity/29390 · Telegram Post
• https://t.me/cvenotify/21727 · Telegram Post