CVE-2022-25364

{"id": "CVE-2022-25364", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2022-03-17T17:15:07.550", "references": [{"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gradle.com/advisory/2022-02", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gradle.com/advisory/2022-02", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as part of a build. As of 2021.4.2, the built-in build cache is inaccessible-by-default, requiring explicit configuration of its access-control settings before it can be used. (Remote build cache nodes are unaffected as they are inaccessible-by-default.)"}, {"lang": "es", "value": "En Gradle Enterprise versiones anteriores a 2021.4.2, la configuraci\u00f3n por defecto de la cach\u00e9 de construcci\u00f3n incorporada permit\u00eda el acceso an\u00f3nimo de escritura. Si esto no es cambiado manualmente, un actor malicioso con acceso a la red a la cach\u00e9 de compilaci\u00f3n podr\u00eda rellenarla con entradas manipuladas que ejecutaran c\u00f3digo malicioso como parte de una compilaci\u00f3n. A partir de la versi\u00f3n 2021.4.2, la cach\u00e9 de compilaci\u00f3n incorporada es inaccesible por defecto, por lo que es necesario configurar expl\u00edcitamente sus par\u00e1metros de control de acceso antes de poder usarla. (Los nodos remotos de la cach\u00e9 de compilaci\u00f3n no est\u00e1n afectados, ya que son inaccesibles por defecto)"}], "lastModified": "2024-11-21T06:52:04.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E24345EF-8922-477E-8407-1318B556D67C", "versionEndExcluding": "2021.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}