Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade satellite-cloneUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade foreman-cliUpgrade rubygem-little-pluggerUpgrade rubygem-hashieUpgrade rubygem-unicodeUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-acceptUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debugsourceUpgrade python39-pulp_manifestUpgrade rubygem-version_gemUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansible | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade satellite-cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffiUpgrade rubygem-http-acceptUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unfUpgrade rubygem-domain_nameUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-hashieUpgrade rubygem-ffi-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_extUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-amazing_printUpgrade rubygem-localeUpgrade rubygem-gssapiUpgrade foreman-cli | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub