CVE-2021-41587: 
Gradle vulnerability analysis and mitigation

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform Server Side Request Forgery (SSRF) attacks can potentially discover credentials for other resources (Gradle Advisory, NVD). The vulnerability was discovered and disclosed in September 2021, affecting Gradle Enterprise versions from 2017.6 through 2021.1.2.

The vulnerability is classified with a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue stems from an unadvertised HTTP endpoint that was only accessible from the server side but could be reached through SSRF attacks. This endpoint exposed private application configuration information containing secrets used as credentials to connect to other systems such as the application database (NVD, Gradle Advisory).

The vulnerability allows attackers to access private application configuration information containing secrets used as credentials to connect to other systems, including the application database. This could potentially lead to unauthorized access to connected systems and exposure of sensitive data (Gradle Advisory).

The vulnerability was fixed in Gradle Enterprise version 2021.1.3, where the vulnerable endpoint now requires extra access credentials. The recommended mitigation is to upgrade to version 2021.1.3 or later (Gradle Advisory).