CVE-2021-26719 Path traversal in n/a
A malicious actor with credentials can exploit a directory traversal flaw in Gradle Enterprise tools to extract files to arbitrary locations via crafted TAR archives.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26719?
CVE-2021-26719 is a medium-severity path traversal vulnerability in n/a, published on 9 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.
Weakness: CWE-22
Which versions are affected by CVE-2021-26719?
It affects 3 products.
Products include Gradle Enterprise Test Distribution Agent, Gradle Maven, Gradle Test Distribution.
How do I fix CVE-2021-26719?
No fix has been published for CVE-2021-26719 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-26719 being exploited?
There is no known exploitation of CVE-2021-26719 in the wild and no public exploit code.
Sources
Also known as GHSA-pj4h-x8qh-45r9, UBUNTU-CVE-2021-26719.