Vulnerability Details CVE-2022-41574
An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 34.3%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2022-41574
-
cpe:2.3:a:gradle:enterprise:2020.4
-
cpe:2.3:a:gradle:enterprise:2021.3
-
cpe:2.3:a:gradle:enterprise:2021.4.2
-
cpe:2.3:a:gradle:enterprise:2021.4.3
-
cpe:2.3:a:gradle:enterprise:2022.1
-
cpe:2.3:a:gradle:enterprise:2022.3.1