Is CVE-2022-23630 actively exploited?

No active exploitation of CVE-2022-23630 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-23630 be exploited remotely?

Yes. CVE-2022-23630 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-23630?

CVE-2022-23630 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2022-23630

HIGH

CVE-2022-23630

CWE-829Published: February 10, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.

NVD Source

Technical Analysis

CVE-2022-23630 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.5.