CVE-2021-41584 Information disclosure in n/a
Attackers can view sensitive build and configuration details by sending a crafted HTTP request with a specific header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41584?
CVE-2021-41584 is a high-severity vulnerability in n/a, published on 24 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header.
Which versions are affected by CVE-2021-41584?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | From 2020.4.0 | 2021.1.3 |
Products include Gradle Gradle.
How do I fix CVE-2021-41584?
Upgrade gradle to 2021.1.3 or later.
Is CVE-2021-41584 being exploited?
There is no known exploitation of CVE-2021-41584 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2021-41584, GHSA-pwr9-qwxg-647h.