CVE-2022-27919

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security.gradle.com/advisory/2022-05Mitigation, Vendor Advisory
https://security.gradle.com/advisory/2022-05Mitigation, Vendor Advisory

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27927.5Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data CVE-2022-279206.1libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.CVE-2022-279247.5Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta CVE-2022-279257.2Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authen CVE-2022-279266.1A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo CVE-2022-279279.8A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker CVE-2022-279287.5Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-279297.5Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27937.8Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no a CVE-2022-279305.9Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identi CVE-2022-279317.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-279327.5Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.