CVE-2023-49238: Critical severity Gradle Enterprise vulnerability
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49238?
The severity of CVE-2023-49238 is considered to be high due to its potential for unauthorized access.
How do I fix CVE-2023-49238?
To fix CVE-2023-49238, ensure that the default initial system user password is changed immediately upon installation.
What software versions are affected by CVE-2023-49238?
CVE-2023-49238 affects Gradle Enterprise versions prior to 2023.1.
Can CVE-2023-49238 be exploited remotely?
Yes, CVE-2023-49238 can be exploited remotely by an attacker if they gain access before the initial password is changed.
Is there a workaround for CVE-2023-49238?
The primary workaround for CVE-2023-49238 is to configure the system securely and enforce password changes immediately after installation.