CVE-2023-49238

9.8 criticalEPSS 0.8%

Critical (9.8) in gradle enterprise. EPSS 0.8% chance of exploitation in the next 30 days.

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-521
Published: 2024-01-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gradle:enterprise

References

https://security.gradle.com
https://security.gradle.com/advisory/2023-01
https://security.netapp.com/advisory/ntap-20240216-0003/
https://security.gradle.com
https://security.gradle.com/advisory/2023-01

Check your stack JSON