1. Home
  2. CVE Database
  3. CVE-2022-41574
HIGH · 7.5

CVE-2022-41574

An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured in...

Vulnerability Description

An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
GradleEnterprise>= 2020.4, < 2022.3.2

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2022-41574?

CVE-2022-41574 is a vulnerability with a CVSS score of 7.5 (HIGH). An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured in...

How severe is CVE-2022-41574?

CVE-2022-41574 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-41574?

Check the references section above for vendor advisories and patch information. Affected products include: Gradle Enterprise.