Critical severity · published Apr 22, 2019
CVE-2019-11403
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Build Cache Node · Gradle
before 5.2 · source: NVD
EN
Enterprise · Gradle
before 2018.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11403
Release Notes
https://gradle.com/enterprise/releases/2018.5/#changes-2
Vendor Advisory
https://security.gradle.com/advisory/CVE-2019-11403
More from Build Cache Node
9.8
CVE-2021-41589
In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the build cache node…