CVE-2023-49238

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-492397.5Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiCVE-2023-49244.3The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability cCVE-2023-492407.5Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-492417.5API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service confCVE-2023-492427.5Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentialCVE-2023-492437.5Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect servCVE-2023-492447.5Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentialiCVE-2023-492457.5Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentialiCVE-2023-492467.5Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiCVE-2023-492477.5Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiaCVE-2023-492485.5Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file accCVE-2023-49254.8The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privi
CVE-2023-49238: Critical severity, CVSS 9.8 | Vulnix