CVE-2021-41586 Server-side request forgery in n/a
An attacker can exploit Server-Side Request Forgery in Gradle Enterprise to reset system user passwords, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41586?
CVE-2021-41586 is a high-severity server-side request forgery vulnerability in n/a, published on 24 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
Weakness: CWE-918
Which versions are affected by CVE-2021-41586?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | From 2020.4.0 | 2021.1.3 |
Products include Gradle Gradle.
How do I fix CVE-2021-41586?
Upgrade gradle to 2021.1.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-41586 being exploited?
There is no known exploitation of CVE-2021-41586 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2021-41586, GHSA-5jm5-rwhx-qv75.