Skip to main content

Gradle CVE-2023-44387

MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2023-10-05 security-advisories@github.com
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 05, 2023 - 18:15 nvd
MEDIUM 6.5

DescriptionNVD

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

AnalysisAI

Gradle is a build tool with a focus on build automation and support for multi-language development. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file. Affected products include: Gradle.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Review and restrict file/resource permissions, apply principle of least privilege.

More in Gradle

View all
CVE-2016-6199 CRITICAL POC
9.8 Feb 07

ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized objec

CVE-2019-15052 CRITICAL POC
9.8 Aug 14

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. Rated

CVE-2021-29428 HIGH POC
7.8 Apr 13

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions

CVE-2021-32751 HIGH POC
7.5 Jul 20

Gradle is a build tool with a focus on build automation. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2021-29427 HIGH POC
7.2 Apr 13

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/

CVE-2023-49238 CRITICAL
9.8 Jan 09

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain insta

CVE-2019-16370 MEDIUM POC
5.9 Sep 16

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an a

CVE-2023-26053 CRITICAL
9.8 Mar 02

Gradle is a build tool with a focus on build automation and support for multi-language development. Rated critical sever

CVE-2022-27919 CRITICAL
9.8 Mar 25

Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial conf

CVE-2021-41589 CRITICAL
9.8 Oct 27

In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and

CVE-2019-11403 CRITICAL
9.8 Apr 22

In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML

CVE-2019-11402 CRITICAL
9.8 Apr 22

In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format. Ra

Share

CVE-2023-44387 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy