CVE-2023-44387 Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations
Gradle incorrectly assigns symlink permissions to copied files, potentially exposing sensitive data or allowing privilege escalation in build artifacts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-44387?
CVE-2023-44387 is a low-severity vulnerability in gradle, published on 5 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.
Weakness: CWE-732
Which versions are affected by CVE-2023-44387?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | All versions | 7.6.3, 8.4.0 |
Products include Gradle Gradle.
How do I fix CVE-2023-44387?
Upgrade gradle to a fixed version for your release line: 7.6.3 or 8.4.0.
Is CVE-2023-44387 being exploited?
There is no known exploitation of CVE-2023-44387 in the wild and no public exploit code.
Other vulnerabilities in gradle
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BELL-CVE-2023-44387, BIT-gradle-2023-44387, DEBIAN-CVE-2023-44387, GHSA-43r3-pqhv-f7h9, UBUNTU-CVE-2023-44387.