Skip to main content

Gradle CVE-2023-42445

MEDIUM
Improper Restriction of XML External Entity Reference (CWE-611)
2023-10-06 security-advisories@github.com
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 06, 2023 - 14:15 nvd
MEDIUM 5.3

DescriptionNVD

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.

AnalysisAI

Gradle is a build tool with a focus on build automation and support for multi-language development. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities. Affected products include: Gradle.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Gradle

View all
CVE-2016-6199 CRITICAL POC
9.8 Feb 07

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized objec

CVE-2019-15052 CRITICAL POC
9.8 Aug 14

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. Rated

CVE-2021-29428 HIGH POC
7.8 Apr 13

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions

CVE-2021-32751 HIGH POC
7.5 Jul 20

Gradle is a build tool with a focus on build automation. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2021-29427 HIGH POC
7.2 Apr 13

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/

CVE-2019-16370 MEDIUM POC
5.9 Sep 16

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an a

CVE-2023-26053 CRITICAL
9.8 Mar 02

Gradle is a build tool with a focus on build automation and support for multi-language development. Rated critical sever

CVE-2021-29429 MEDIUM POC
5.5 Apr 12

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacke

CVE-2023-35947 HIGH
8.1 Jun 30

Gradle is a build tool with a focus on build automation and support for multi-language development. Rated high severity

CVE-2021-41588 HIGH
8.1 Sep 24

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. Ra

CVE-2021-41587 HIGH
7.5 Sep 24

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover cred

CVE-2021-41586 HIGH
7.5 Sep 24

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the sys

Share

CVE-2023-42445 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy