CVE-2021-41619

moderate-risk
Published 2021-10-27

An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host, should an attacker gain administrative access to the application.

Do I need to act?

~
3.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Gradle

References (4)

Vendor Advisory https://security.gradle.com
Vendor Advisory https://security.gradle.com/advisory/2021-08
Vendor Advisory https://security.gradle.com
Vendor Advisory https://security.gradle.com/advisory/2021-08
38
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 7/34 · Low
Exposure 5/34 · Minimal