CVE-2023-49238

{"id": "CVE-2023-49238", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-09T02:15:44.837", "references": [{"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gradle.com/advisory/2023-01", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20240216-0003/", "source": "cve@mitre.org"}, {"url": "https://security.gradle.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gradle.com/advisory/2023-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240216-0003/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in."}, {"lang": "es", "value": "En Gradle Enterprise anterior a 2023.1, un atacante remoto podr\u00eda obtener acceso a una nueva instalaci\u00f3n (en ciertos escenarios de instalaci\u00f3n) debido a una contrase\u00f1a de usuario inicial del sistema no \u00fanica. Aunque esta contrase\u00f1a debe cambiarse en el primer inicio de sesi\u00f3n, es posible que un atacante inicie sesi\u00f3n antes que el administrador leg\u00edtimo."}], "lastModified": "2024-11-21T08:33:05.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "178FB462-CD29-4999-96A5-C47BFEF71C7A", "versionEndExcluding": "2023.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}