CVE-2023-49238 Hardcoded credentials in n/a
Remote attackers can gain unauthorized access to new Gradle Enterprise installations by exploiting non-unique initial system user passwords before the administrator logs in.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49238?
CVE-2023-49238 is a critical vulnerability in n/a, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
Weakness: CWE-521
Which versions are affected by CVE-2023-49238?
It affects 1 product.
Products include Gradle Enterprise.
How do I fix CVE-2023-49238?
No fix has been published for CVE-2023-49238 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-49238 being exploited?
There is no known exploitation of CVE-2023-49238 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4766-3xqh-rp5x.