CVE-2023-35946

CVSS Score of 10 (low)

Details

Published Jun 30, 2023
Updated: Mar 6, 2024
CWE ID 22

Summary

CVE-2023-35946 is a vulnerability affecting Gradle, a build tool used for build automation and multi-language development. This vulnerability allows an attacker to write files into unintended locations within the dependency cache, potentially overwriting important files or poisoning the cache. Exploiting this vulnerability requires control over a dependency repository or the ability to modify the build's configuration. The issue has been addressed in Gradle versions 7.6.2 and 8.2, which now refuse to cache dependencies with path traversal elements in their coordinates. The potential danger posed by this vulnerability includes data loss, system compromise, or disruption of operations if critical files are overwritten or tampered with.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-35946 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options