CVE-2022-30586 Missing authorization in n/a
Attackers can exploit incorrect access control in Gradle Enterprise to achieve arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30586?
CVE-2022-30586 is a high-severity missing authorization vulnerability in n/a, published on 6 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.
Weakness: CWE-200
Which versions are affected by CVE-2022-30586?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | All versions | 1.3.1 |
Products include Gradle Gradle.
How do I fix CVE-2022-30586?
Upgrade gradle to 1.3.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-30586 being exploited?
There is no known exploitation of CVE-2022-30586 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2022-30586, GHSA-wf74-667m-qg32.