PT-2021-23353 · Gradle · Gradle Enterprise

Stephan Sekula · Published 2021-10-27 · Updated 2022-07-12 · CVE-2021-41590

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions through 2021.3

Description The issue allows probing of the server-side network environment via an SMTP configuration test. Administrators can test configured SMTP server settings through the installation configuration user interface, which can reveal information about the internal network environment by identifying listening TCP ports available to the server.

Recommendations For versions through 2021.3, consider restricting access to the SMTP configuration test function to minimize the risk of internal network environment probing. As a temporary workaround, limit the use of the SMTP server settings testing feature until a patch is available.

Fix

Related Identifiers

CVE-2021-41590

Affected Products

Gradle Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-41590 · Security Note
• https://security.gradle.com/advisory/2021-07 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41590 · Vendor Advisory
• https://security.gradle.com · Vendor Advisory
• https://t.me/cibsecurity/31273 · Telegram Post
• https://t.me/cvenotify/22471 · Telegram Post