Build cache user credentials are stored unencrypted at the Gradle Enterprise server, and build cache nodes. An attacker gaining access to the server can obtain the passwords used to access the cache via the HTTP interface.
← All advisories
Build cache credentials are stored unencrypted at rest
- Affected product(s)
- Gradle Enterprise < 2018.5.3
- Gradle Enterprise Build Cache Node < 6.0
- Severity
- High
- Published
- April 22, 2019
- Related CVE ID(s)
Description
Mitigation
Upgrade to Gradle Enterprise 2018.5.3 and/or Gradle Enterprise Build Cache Node 6.0.