CVE-2025-24858

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-24858", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-12T20:01:14.275Z", "dateReserved": "2025-01-26T00:00:00.000Z", "datePublished": "2025-01-26T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Enterprise", "vendor": "Gradle", "versions": [{"lessThan": "2024.1.9", "status": "affected", "version": "2020.4", "versionType": "custom"}, {"lessThan": "2024.2.7", "status": "affected", "version": "2024.2", "versionType": "custom"}, {"lessThan": "2024.3.1", "status": "affected", "version": "2024.3", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-01-26T06:12:51.717Z"}, "references": [{"url": "https://security.gradle.com/advisory/2025-01"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "versionStartIncluding": "2020.4", "versionEndExcluding": "2024.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "versionStartIncluding": "2024.2", "versionEndExcluding": "2024.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "versionStartIncluding": "2024.3", "versionEndExcluding": "2024.3.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T14:05:18.040589Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:01:14.275Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24858", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T14:05:18.040589Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T19:54:00.710Z"}}], "cna": {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Gradle", "product": "Enterprise", "versions": [{"status": "affected", "version": "2020.4", "lessThan": "2024.1.9", "versionType": "custom"}, {"status": "affected", "version": "2024.2", "lessThan": "2024.2.7", "versionType": "custom"}, {"status": "affected", "version": "2024.3", "lessThan": "2024.3.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://security.gradle.com/advisory/2025-01"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2024.1.9", "versionStartIncluding": "2020.4"}, {"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2024.2.7", "versionStartIncluding": "2024.2"}, {"criteria": "cpe:2.3:a:gradle:enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2024.3.1", "versionStartIncluding": "2024.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-01-26T06:12:51.717Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24858", "state": "PUBLISHED", "dateUpdated": "2025-02-12T20:01:14.275Z", "dateReserved": "2025-01-26T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-01-26T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Enterprise", "vendor": "Gradle", "versions": [{"lessThan": "2024.1.9", "status": "affected", "version": "2020.4", "versionType": "custom"}, {"lessThan": "2024.2.7", "status": "affected", "version": "2024.2", "versionType": "custom"}, {"lessThan": "2024.3.1", "status": "affected", "version": "2024.3", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password."}, {"lang": "es", "value": "Develocity (anteriormente Gradle Enterprise) antes de la versi\u00f3n 2024.3.1 permite que un atacante que tenga acceso de red a un servidor de Develocity obtenga la contrase\u00f1a cifrada del usuario sistema. El algoritmo de cifrado utilizado por Develocity se eligi\u00f3 de acuerdo con las mejores pr\u00e1cticas para el almacenamiento de contrase\u00f1as y brinda cierta protecci\u00f3n contra intentos de ataque por fuerza bruta. La gravedad aplicable de esta vulnerabilidad depende de si un servidor de Develocity es accesible por usuarios externos o no autorizados y de la complejidad de la contrase\u00f1a del usuario System."}], "id": "CVE-2025-24858", "lastModified": "2026-06-17T08:59:44.857", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-24858", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-27T14:05:18.040589Z", "version": "2.0.3"}}]}, "published": "2025-01-26T06:15:23.470", "references": [{"source": "cve@mitre.org", "url": "https://security.gradle.com/advisory/2025-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"created": "2025-07-13T11:07:09.279794+00:00", "updated": "2025-07-13T11:07:09.279852+00:00", "vendors": ["gradle", "gradle$PRODUCT$enterprise"]}