CVE-2023-49238 is a flaw in Gradle Enterprise before 2023.1: a non-unique initial system user password lets a remote attacker reach a new installation before its administrator. NVD scores it critical, 9.8, while Gradle rates it moderate. Upgrade to 2023.1 or later.
What's affected
The NVD record says Gradle Enterprise before 2023.1 is affected, in certain installation scenarios. Gradle's advisory 2023-01, which now lives on the Develocity site, agrees on the versions: releases before 2023.1 are affected and 2023.1 and later generate a unique initial system user password.
The two sources disagree on severity. NVD gives the record 9.8 Critical with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Gradle's advisory labels it Moderate. The gap likely reflects the conditions: the advisory says installations are not vulnerable if they used an unattended installation that requires a custom system user password, or a manual installation that enforces changing the initial password on first login.
How to check if you're exposed
Check the installed version in the administration area of Gradle Enterprise, which is now called Develocity. Any version before 2023.1 is in scope.
Then check how the installation was created. The advisory describes two safe patterns: an unattended installation with a custom system user password, and a manual installation that forced a password change on first login. If your instance was built another way and has been running since before 2023.1, confirm that the initial system user password was changed and review the accounts that exist.
What to do now
- Find your Gradle Enterprise version and compare it with 2023.1.
- Upgrade to 2023.1 or later, which generates a unique initial system user password.
- If you cannot upgrade yet, build any new installation with the unattended installation process and a non-default system user password, as the advisory says.
- On existing instances, confirm the initial system user password was changed, and review the list of users and access keys for anything unexpected.
- Keep new installations off the internet until the administrator has completed first login.
Why it matters
The weakness is CWE-521, weak password requirements. A default or shared initial password is a known value. Anyone who can reach the login page of a fresh installation before the administrator signs in could use it.
This is a race, and the attack window exists only for new installations. That explains the moderate label from the vendor and the critical label from NVD: the base score assumes the attacker can reach the system, while the vendor weighs the narrow conditions. Both views are useful, and your own exposure depends on how and when you installed. KEV status is false for this CVE.
The product is a build tooling server, so access to it can mean access to build data and settings. That is a reason to treat the first login of any new build infrastructure as a controlled step.
Quick check
NVD says critical and Gradle says moderate. Which should I follow?
Follow the version guidance, which matches in both. Use the higher score if you want a cautious priority, and use the advisory's conditions to judge your real exposure.
Do I need to upgrade if I changed the password at first login?
The advisory lists installations that enforce a password change on first login as not vulnerable. Upgrading to 2023.1 or later is still the recommended path.
Sources
Gradle security advisory 2023-01 (now hosted on the Develocity site)
Last reviewed: 19 October 2026.
