What’s Vulnerable › Vulnerabilities

CVE-2023-49238

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-09 · updated 2026-06-17
• Weakness: CWE-521

Description

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.

Affected products

• Gradle Enterprise: before 2023.1 — fixed in 2023.1

How to fix

Upgrade to a fixed version: Gradle Enterprise 2023.1. Check the vendor advisory for mitigations.

References

• https://security.gradle.com
• https://security.gradle.com/advisory/2023-01
• https://security.netapp.com/advisory/ntap-20240216-0003/
• https://security.gradle.com
• https://security.gradle.com/advisory/2023-01
• https://security.netapp.com/advisory/ntap-20240216-0003/

Get alerted when CVE-2023-49238 or the next vulnerability affects your stack