CVE-2021-41584

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415857.5Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop CVE-2021-415867.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.CVE-2021-415877.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other re CVE-2021-415888.1In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have CVE-2021-415899.8In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code executi CVE-2021-41594.4A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be ret CVE-2021-415905.3In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installati CVE-2021-415919.4ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.CVE-2021-415929.4Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.CVE-2021-415938.6Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.CVE-2021-415946.5In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API req CVE-2021-415955.3SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files