{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-42445", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-08T20:57:45.572Z", "datePublished": "2023-10-06T13:52:02.982Z", "dateUpdated": "2025-02-13T17:09:20.513Z"}, "containers": {"cna": {"title": "Possible local file exfiltration by XML External entity injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "lang": "en", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8"}, {"name": "https://github.com/gradle/gradle/releases/tag/v7.6.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/gradle/gradle/releases/tag/v7.6.3"}, {"name": "https://github.com/gradle/gradle/releases/tag/v8.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gradle/gradle/releases/tag/v8.4.0"}, {"url": "https://security.netapp.com/advisory/ntap-20231110-0006/"}], "affected": [{"vendor": "gradle", "product": "gradle", "versions": [{"version": "< 8.4", "status": "affected"}, {"version": "< 7.6.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-11-10T18:06:29.614Z"}, "descriptions": [{"lang": "en", "value": "Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities."}], "source": {"advisory": "GHSA-mrff-q8qj-xvg8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:23:38.775Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8"}, {"name": "https://github.com/gradle/gradle/releases/tag/v7.6.3", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gradle/gradle/releases/tag/v7.6.3"}, {"name": "https://github.com/gradle/gradle/releases/tag/v8.4.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/gradle/gradle/releases/tag/v8.4.0"}, {"url": "https://security.netapp.com/advisory/ntap-20231110-0006/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*", "matchCriteriaId": "77803A01-94E7-4C76-BAF3-ED44AE596010", "versionEndExcluding": "7.6.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*", "matchCriteriaId": "E104EF19-8B72-4A31-B2AC-8312F7C6452F", "versionEndExcluding": "8.4.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities."}, {"lang": "es", "value": "Gradle es una herramienta de compilaci\u00f3n centrada en la automatizaci\u00f3n de la build y soporte para el desarrollo en varios idiomas. En algunos casos, cuando Gradle analiza archivos XML, la resoluci\u00f3n de entidades externas XML no est\u00e1 deshabilitada. Combinado con un ataque XXE fuera de banda (OOB-XXE), el simple hecho de analizar XML puede provocar la filtraci\u00f3n de archivos de texto locales a un servidor remoto. Gradle analiza archivos XML para varios prop\u00f3sitos. La mayor\u00eda de las veces, Gradle analiza los archivos XML que gener\u00f3 o que ya estaban presentes localmente. Gradle solo puede recuperar los descriptores XML de Ivy y los archivos POM de Maven de repositorios remotos y analizarlos. En Gradle 7.6.3 y 8.4, la resoluci\u00f3n de entidades externas XML se ha deshabilitado para todos los casos de uso para proteger contra esta vulnerabilidad. Gradle ahora se negar\u00e1 a analizar archivos XML que tengan entidades externas XML."}], "id": "CVE-2023-42445", "lastModified": "2025-02-13T17:17:08.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-06T14:15:12.103", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/gradle/gradle/releases/tag/v7.6.3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/gradle/gradle/releases/tag/v8.4.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231110-0006/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/gradle/gradle/releases/tag/v7.6.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/gradle/gradle/releases/tag/v8.4.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231110-0006/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7678", "cpe": "cpe:/a:redhat:amq_streams:2", "package": "gradle", "product_name": "Red Hat AMQ Streams 2.6.0", "release_date": "2023-12-06T00:00:00Z"}], "bugzilla": {"description": "gradle: Possible local text file exfiltration by XML External entity injection", "id": "2242538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242538"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-611", "details": ["Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.", "A flaw was found in Gradle. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), parsing XML can lead to the exfiltration of local text files to a remote server. In most cases, Gradle parses XML files it generated, or that were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle."], "name": "CVE-2023-42445", "package_state": [{"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Affected", "package_name": "gradle", "product_name": "Red Hat build of Apicurio Registry"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Will not fix", "package_name": "gradle", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "gradle", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Not affected", "package_name": "gradle", "product_name": "Red Hat Integration Camel Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "gradle", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "gradle", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "gradle", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "gradle", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Will not fix", "package_name": "rh-maven36-byte-buddy", "product_name": "Red Hat Software Collections"}], "public_date": "2023-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-42445\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42445\nhttps://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8"], "threat_severity": "Moderate", "upstream_fix": "gradle 7.6.3, gradle 8.4"}