Lucene search

MitreCVE-2022-41574

HistoryOct 07, 2022 - 9:15 p.m.

CVE-2022-41574

2022-10-0721:15:12

CWE-863

mitre

web.nvd.nist.gov

cve-2022-41574

access control

vulnerability

gradle enterprise

remote attackers

http access

endpoint

security issue

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.

Affected configurations

Nvd

Node

gradleenterpriseRange2020.4–2022.3.2

VendorProductVersionCPE
gradleenterprise*cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gradle	enterprise	*	cpe:2.3:a:gradle:enterprise::::::::

References

security.gradle.com

security.gradle.com/advisory/2022-12

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

Related for CVE-2022-41574