CVE-2023-49238

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.gradle.com	Vendor Advisory
https://security.gradle.com/advisory/2023-01	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240216-0003/
https://security.gradle.com	Vendor Advisory
https://security.gradle.com/advisory/2023-01	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240216-0003/

Configurations

Configuration 1 (hide)

cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:33

Type	Values Removed	Values Added
References	~~() https://security.gradle.com - Vendor Advisory~~	() https://security.gradle.com - Vendor Advisory
References	~~() https://security.gradle.com/advisory/2023-01 - Vendor Advisory~~	() https://security.gradle.com/advisory/2023-01 - Vendor Advisory
References	~~() https://security.netapp.com/advisory/ntap-20240216-0003/ -~~	() https://security.netapp.com/advisory/ntap-20240216-0003/ -

16 Feb 2024, 13:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20240216-0003/ -

16 Jan 2024, 15:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-09 02:15

Updated : 2025-06-17 16:15

NVD link : CVE-2023-49238

Mitre link : CVE-2023-49238

CVE.ORG link : CVE-2023-49238

JSON object : View

Products Affected

gradle

enterprise

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2023-49238", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-09T02:15:44.837", "references": [{"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gradle.com/advisory/2023-01", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20240216-0003/", "source": "cve@mitre.org"}, {"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gradle.com/advisory/2023-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240216-0003/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in."}, {"lang": "es", "value": "En Gradle Enterprise anterior a 2023.1, un atacante remoto podr\u00eda obtener acceso a una nueva instalaci\u00f3n (en ciertos escenarios de instalaci\u00f3n) debido a una contrase\u00f1a de usuario inicial del sistema no \u00fanica. Aunque esta contrase\u00f1a debe cambiarse en el primer inicio de sesi\u00f3n, es posible que un atacante inicie sesi\u00f3n antes que el administrador leg\u00edtimo."}], "lastModified": "2025-06-17T16:15:25.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "178FB462-CD29-4999-96A5-C47BFEF71C7A", "versionEndExcluding": "2023.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}