Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-libUpgrade maven-wagon-http-lightweightUpgrade modello-maven-plugin-javadocUpgrade gmavenplus-pluginUpgrade maven-jar-plugin-bootstrapUpgrade hawtjni-maven-pluginUpgrade maven-artifact-resolver-javadocUpgrade maven-resolver-implUpgrade maven-wagon-ftpUpgrade string-template-maven-pluginUpgrade maven-wagon-httpUpgrade maven-wagon-ssh-commonUpgrade maven-remote-resources-plugin-javadocUpgrade maven-invokerUpgrade maven-plugin-tools-javaUpgrade maven-install-pluginUpgrade maven-plugin-pluginUpgrade maven-doxia-module-xhtml5Upgrade maven-toolchainUpgrade maven-mappingUpgrade maven-plugin-bundleUpgrade maven-shared-utils-javadocUpgrade maven-plugin-bundle-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-verifierUpgrade maven-doxia-module-confluenceUpgrade maven-plugin-tools-apiUpgrade maven-resolver-connector-basicUpgrade maven-jar-plugin-javadocUpgrade maven-plugin-descriptorUpgrade maven-surefire-provider-junitUpgrade maven-surefire-plugin-bootstrapUpgrade tesla-polyglot-maven-pluginUpgrade maven-wagon-sshUpgrade maven-surefire-report-pluginUpgrade maven-wagon-http-sharedUpgrade maven-resolver-spiUpgrade maven-doxia-logging-apiUpgrade xml-maven-plugin-javadocUpgrade hawtjni-maven-plugin-javadocUpgrade maven-doxia-module-latexUpgrade maven-monitorUpgrade maven-plugin-registryUpgrade maven-compiler-plugin-bootstrapUpgrade maven-doxia-coreUpgrade maven-doxia-sitetoolsUpgrade maven-artifact-resolverUpgrade maven-plugin-tools-generatorsUpgrade maven-failsafe-plugin-bootstrapUpgrade bnd-maven-pluginUpgrade maven-dependency-analyzerUpgrade maven-filteringUpgrade maven-remote-resources-pluginUpgrade maven-resolver-test-utilUpgrade maven-doxia-test-docsUpgrade maven-script-antUpgrade maven-artifact-transfer-javadocUpgrade maven-doxia-module-xdocUpgrade maven-resolver-transport-wagonUpgrade maven-shared-io-javadocUpgrade maven-source-plugin-javadocUpgrade maven-script-beanshellUpgrade maven-wagon-javadocUpgrade maven-resolver-transport-fileUpgrade maven-resolverUpgrade maven-enforcer-rulesUpgrade maven-plugin-tools-antUpgrade maven-clean-pluginUpgrade maven-enforcer-javadocUpgrade mavenUpgrade maven-invoker-javadocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-artifactUpgrade antlr4-maven-pluginUpgrade maven-doxia-module-aptUpgrade maven-resources-plugin-bootstrapUpgrade maven-surefire-plugins-javadocUpgrade maven2-javadocUpgrade maven-mapping-javadocUpgrade os-maven-pluginUpgrade maven-dependency-treeUpgrade maven-artifact-transferUpgrade maven-compiler-plugin-javadocUpgrade maven-wagon-ssh-externalUpgrade maven-javadoc-pluginUpgrade maven-file-management-javadocUpgrade maven-surefire-report-parserUpgrade maven-shared-utilsUpgrade maven-resolver-utilUpgrade maven-surefireUpgrade maven-reporting-api-javadocUpgrade maven-resources-plugin-javadocUpgrade maven-plugin-annotationsUpgrade maven-plugin-testing-javadocUpgrade maven-enforcerUpgrade maven-surefire-javadocUpgrade os-maven-plugin-javadocUpgrade maven-shared-ioUpgrade maven-wagon-fileUpgrade maven-doxia-module-xhtmlUpgrade maven-resolver-transport-classpathUpgrade maven-clean-plugin-javadocUpgrade maven-dependency-pluginUpgrade maven-file-managementUpgrade maven-dependency-tree-javadocUpgrade maven-common-artifact-filtersUpgrade exec-maven-pluginUpgrade maven-source-pluginUpgrade maven-plugin-testingUpgrade maven-plugin-build-helperUpgrade maven-plugin-tools-modelUpgrade maven-doxia-sitetools-javadocUpgrade maven-verifier-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-surefire-pluginUpgrade spec-version-maven-plugin-javadocUpgrade string-template-maven-plugin-javadocUpgrade maven-surefire-provider-testngUpgrade spec-version-maven-pluginUpgrade maven-common-artifact-filters-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-artifact-managerUpgrade maven-shared-incremental-javadocUpgrade maven-resolver-transport-httpUpgrade maven-compiler-pluginUpgrade maven-doxia-javadocUpgrade javacc-maven-plugin-javadocUpgrade maven-plugin-plugin-bootstrapUpgrade maven-doxia-sink-apiUpgrade maven-resolver-javadocUpgrade maven-plugin-build-helper-javadocUpgrade gmavenplus-plugin-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-jar-pluginUpgrade maven-doxia-module-fmlUpgrade maven-doxia-module-docbook-simpleUpgrade maven-dependency-analyzer-javadocUpgrade maven-doxia-module-twikiUpgrade maven-filtering-javadocUpgrade maven-wagon-provider-apiUpgrade maven-enforcer-pluginUpgrade maven-plugin-tools-javadocUpgrade maven-projectUpgrade maven-resolver-named-locksUpgrade modello-maven-pluginUpgrade maven-modelUpgrade maven-reporting-apiUpgrade maven-resolver-apiUpgrade maven-plugin-tools-beanshellUpgrade maven-profileUpgrade maven-settingsUpgrade maven-doxia-module-rtfUpgrade maven-archiverUpgrade maven-antrun-plugin-javadocUpgrade maven-antrun-pluginUpgrade xml-maven-pluginUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-surefire-report-plugin-bootstrapUpgrade paranamer-maven-pluginUpgrade maven-assembly-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-javadoc-plugin-javadocUpgrade maven-resources-pluginUpgrade exec-maven-plugin-javadocUpgrade javacc-maven-pluginUpgrade bnd-maven-plugin-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-test-toolsUpgrade maven-javadocUpgrade maven-shared-incrementalUpgrade maven-install-plugin-javadocUpgrade maven-localUpgrade maven-doxia-module-foUpgrade maven-dependency-plugin-javadocUpgrade maven-failsafe-pluginUpgrade maven-archiver-javadoc | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade libmaven3-core-java (Ubuntu Pro)Upgrade mavenUpgrade maven (Ubuntu Pro)Upgrade libmaven3-core-java | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub