CVE-2025-24858

State: Published
Severity: 8.3 High
Published: Jan 26, 2025
Updated: Feb 12, 2025
Reserved: Jan 26, 2025

Description

Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	mitre

Weaknesses

CWE-201 Insertion of Sensitive Information Into Sent Data

Affected Products

Product	Versions
EnterpriseGradle	2020.4 to before 2024.1.9Affected 2024.2 to before 2024.2.7Affected 2024.3 to before 2024.3.1Affected

References

https://security.gradle.com/advisory/2025-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.