PT-2022-18690 · Gradle · Gradle Enterprise

Published 2022-03-25 · Updated 2023-08-08 · CVE-2022-27919

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2022.1

Description The issue allows remote code execution if the installation process did not specify an initial configuration file, enabling certain anonymous access to administration and an API.

Recommendations For Gradle Enterprise versions prior to 2022.1, ensure that an initial configuration file is specified during the installation process to prevent remote code execution. As a temporary workaround, consider restricting anonymous access to administration and the API until a fixed version is installed.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-27919

Affected Products

Gradle Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-27919 · Security Note
• https://security.gradle.com/advisory/2022-05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27919 · Vendor Advisory
• https://t.me/cibsecurity/39577 · Telegram Post