CVE-2021-41590

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-27 · updated 2026-06-17

Description

In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify the listening TCP ports available to the server, revealing information about the internal network environment.

Affected products

Gradle Enterprise: from 2020.4 before 2021.3 — fixed in 2021.3

How to fix

Upgrade to a fixed version: Gradle Enterprise 2021.3. Check the vendor advisory for mitigations.

References

https://security.gradle.com
https://security.gradle.com/advisory/2021-07
https://security.gradle.com
https://security.gradle.com/advisory/2021-07

Get alerted when CVE-2021-41590 or the next vulnerability affects your stack