CVE-2021-41587 Server-side request forgery in n/a
An attacker can perform Server-Side Request Forgery to discover credentials for other resources in Gradle Enterprise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41587?
CVE-2021-41587 is a high-severity server-side request forgery vulnerability in n/a, published on 24 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
Weakness: CWE-918
Which versions are affected by CVE-2021-41587?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | From 2017.6.0 | 2021.1.3 |
Products include Gradle Gradle.
How do I fix CVE-2021-41587?
Upgrade gradle to 2021.1.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-41587 being exploited?
There is no known exploitation of CVE-2021-41587 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2021-41587, GHSA-c9qc-5g7m-f8w6.