CVE-2023-44387
MEDIUM EPSS 11.2%
Published Oct 5, 20232y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Published Oct 5, 2023 2y ago
Last Modified Jun 17, 2026 2w ago
Description
Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
11.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-732
Affected Products 2
References 5
- github.com https://github.com/gradle/gradle/commit/3b406191e24d69e7e42dc3f3b5cc50625aa930b7
- github.com https://github.com/gradle/gradle/releases/tag/v7.6.3
- github.com https://github.com/gradle/gradle/releases/tag/v8.4.0
- github.com https://github.com/gradle/gradle/security/advisories/GHSA-43r3-pqhv-f7h9
- security.netapp.com https://security.netapp.com/advisory/ntap-20231110-0006/
Remediation
- github.com https://github.com/gradle/gradle/commit/3b406191e24d69e7e42dc3f3b5cc50625aa930b7