CVE-2021-41588

HIGH

Gradle < 2021.1.3 - Insecure Deserialization

Title source: rule

Description

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys.

References (1)

[Vendor Advisory] https://security.gradle.com/advisory/2021-03

Scores

CVSS v3 8.1

EPSS 0.0019

EPSS Percentile 41.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

gradle/gradle < 2021.1.3

Timeline

Published Sep 24, 2021

Tracked Since Feb 18, 2026