Skip to content
Fencer Vulns
low 3.2

CVE-2023-44387 json

Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations

published 2023-10-05 3 y ago modified 2026-10-08 31 d ago also BIT-gradle-2023-44387 , EUVD-2023-48735 , GHSA-43r3-pqhv-f7h9

cvss
3.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

Patch / fix

  • bitnami gradle 7.6.3, 8.4.0
  • gradle gradle 7.6.3, 8.4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-44387 updated cvss 3.2

gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations

  • Red Hat build of Apicurio Registry 2 gradle gradle Red Hat build of OptaPlanner 8 gradle gradle Red Hat Integration Camel K 1 gradle gradle
    affected: workaround, no fix available “User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions”
  • Red Hat JBoss Enterprise Application Platform 6 gradle gradle Red Hat Process Automation 7 gradle gradle Red Hat Software Collections rh-maven36-byte-buddy, rh-maven36-byte-buddy-agent, rh-maven36-byte-buddy-parent, rh-maven36-byte-buddy-javadoc, rh-maven36-byte-buddy-maven-plugin
    affected: workaround, no fix planned “User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions”
  • Red Hat AMQ Streams 2.6.0
    fixed: vendor fix “User should follow the documentation to explicitly set permissions when copying or create archives: https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions” RHSA-2023:7678
  • Red Hat Integration Camel Quarkus 2 gradle gradle Red Hat JBoss Enterprise Application Platform 7 gradle gradle Red Hat JBoss Enterprise Application Platform Expansion Pack gradle gradle
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
OSV 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami gradle
<7.6.3
>=8.0.0, <8.4.0
7.6.3
8.4.0

Affected products

  • gradle gradle

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.