CVE-2023-44387

CVE-2023-44387 is a low-severity vulnerability in Gradle with a CVSS 3.x base score of 3.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Description

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

Frequently asked questions

What is CVE-2023-44387?
Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.
How severe is CVE-2023-44387?
CVE-2023-44387 has a CVSS 3.x base score of 3.2, rated low severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2023-44387 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-44387?
CVE-2023-44387 affects Gradle. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-44387?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-44387 published?
CVE-2023-44387 was published on 2023-10-05 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Gradle

All CVEs affecting Gradle →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →