CVE-2023-44387 | Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

Published: 2023-10-05 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2023-44387 is rated Low Risk (18.2/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.06%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2023-44387

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-03-17 0.04% 0.06% +0.01%
2 2023-10-06 — 0.04% —

Full EPSS history (2 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2023-44387

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
3.2 3.1 LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H)
They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 1.5 1.4 [email protected]
6.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 2.0 4.0 [email protected]

Weakness enumeration for CVE-2023-44387

OS Trackers for CVE-2023-44387

vendor priority summary link
alpine — CVE-2023-44387: 1 source package rows (gradle); 7 state rows across 3 repos (3.18-community, 3.22-community, edge-community); fixed 0, open 7. https://security.alpinelinux.org/vuln/CVE-2023-44387
debian not yet assigned CVE-2023-44387 not yet assigned priority: Debian including 1 source packages (gradle), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 5. https://security-tracker.debian.org/tracker/CVE-2023-44387
redhat low — https://access.redhat.com/security/cve/CVE-2023-44387
suse low CVE-2023-44387 severity low: SUSE including 1 source package names (gradle), 17 product×package rows across 17 product lines (SUSE Enterprise Storage 7.1, SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS, … (17 product lines)): Will Not Fix 17. https://www.suse.com/security/cve/CVE-2023-44387/
ubuntu medium CVE-2023-44387 medium priority: Ubuntu including 1 source packages (gradle), 12 status rows across 12 suites (bionic, focal, jammy, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): needs-triage 7, ignored 5. https://ubuntu.com/security/CVE-2023-44387

Affected software / configurations for CVE-2023-44387

Vendor Product Version Raw CPE
gradle gradle < 7.6.3 cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*
gradle gradle >= 8.0.0, < 8.4.0 cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*

References for CVE-2023-44387

cvelogic Threat Intelligence