Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-artifactUpgrade maven-libUpgrade maven-shared-utils-javadocUpgrade maven-jar-plugin-bootstrapUpgrade string-template-maven-pluginUpgrade maven-plugin-pluginUpgrade maven-doxia-module-xdocUpgrade maven-plugin-tools-antUpgrade maven-plugin-bundleUpgrade maven-doxia-module-confluenceUpgrade maven-jar-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade maven-plugin-tools-javaUpgrade gmavenplus-pluginUpgrade maven-resolver-transport-wagonUpgrade maven-plugin-descriptorUpgrade maven-enforcer-javadocUpgrade maven-verifierUpgrade maven-surefire-report-pluginUpgrade maven-wagon-ftpUpgrade maven-invoker-javadocUpgrade maven-doxia-module-aptUpgrade maven-doxia-test-docsUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-wagon-http-sharedUpgrade maven-wagon-sshUpgrade maven-resolver-test-utilUpgrade maven-surefire-plugins-javadocUpgrade mavenUpgrade maven-invokerUpgrade modello-maven-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade bnd-maven-pluginUpgrade maven-enforcer-rulesUpgrade maven-resolverUpgrade maven-compiler-plugin-javadocUpgrade maven-resolver-transport-fileUpgrade tesla-polyglot-maven-pluginUpgrade maven-artifact-resolver-javadocUpgrade maven-artifact-resolverUpgrade maven-source-plugin-javadocUpgrade maven-dependency-treeUpgrade maven-filteringUpgrade maven-compiler-plugin-bootstrapUpgrade maven-script-antUpgrade maven-artifact-transferUpgrade maven-doxia-module-latexUpgrade maven-surefire-provider-junitUpgrade hawtjni-maven-pluginUpgrade hawtjni-maven-plugin-javadocUpgrade maven-clean-pluginUpgrade maven-plugin-registryUpgrade maven-resolver-implUpgrade maven-surefire-plugin-bootstrapUpgrade maven-plugin-tools-apiUpgrade maven2-javadocUpgrade maven-wagon-httpUpgrade maven-plugin-tools-annotationsUpgrade maven-monitorUpgrade maven-wagon-ssh-commonUpgrade maven-mapping-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-doxia-logging-apiUpgrade maven-wagon-http-lightweightUpgrade maven-doxia-module-xhtml5Upgrade maven-shared-io-javadocUpgrade maven-plugin-bundle-javadocUpgrade os-maven-pluginUpgrade maven-resolver-connector-basicUpgrade maven-resolver-spiUpgrade maven-toolchainUpgrade maven-wagon-javadocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-script-beanshellUpgrade maven-dependency-analyzerUpgrade maven-doxia-coreUpgrade maven-doxia-sitetoolsUpgrade maven-remote-resources-plugin-javadocUpgrade maven-resources-plugin-bootstrapUpgrade maven-install-pluginUpgrade antlr4-maven-pluginUpgrade maven-mappingUpgrade xml-maven-plugin-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-verifier-javadocUpgrade maven-resolver-apiUpgrade maven-source-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-modelUpgrade maven-shared-utilsUpgrade maven-clean-plugin-javadocUpgrade maven-antrun-pluginUpgrade gmavenplus-plugin-javadocUpgrade maven-surefire-pluginUpgrade maven-compiler-pluginUpgrade string-template-maven-plugin-javadocUpgrade maven-test-toolsUpgrade maven-archiverUpgrade maven-doxia-sitetools-javadocUpgrade maven-reporting-api-javadocUpgrade maven-dependency-tree-javadocUpgrade maven-file-management-javadocUpgrade maven-common-artifact-filtersUpgrade exec-maven-pluginUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-shared-incrementalUpgrade maven-resolver-transport-classpathUpgrade maven-doxia-sink-apiUpgrade paranamer-maven-pluginUpgrade maven-antrun-plugin-javadocUpgrade xml-maven-pluginUpgrade maven-surefire-report-parserUpgrade maven-javadocUpgrade exec-maven-plugin-javadocUpgrade maven-settingsUpgrade bnd-maven-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-plugin-testing-toolsUpgrade maven-doxia-module-rtfUpgrade maven-profileUpgrade maven-plugin-tools-beanshellUpgrade spec-version-maven-plugin-javadocUpgrade javacc-maven-pluginUpgrade maven-resources-pluginUpgrade maven-plugin-testingUpgrade maven-plugin-build-helperUpgrade maven-plugin-tools-modelUpgrade maven-surefire-provider-junit5Upgrade maven-wagon-fileUpgrade maven-enforcerUpgrade maven-doxia-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-failsafe-pluginUpgrade javacc-maven-plugin-javadocUpgrade maven-resolver-transport-httpUpgrade spec-version-maven-pluginUpgrade maven-shared-incremental-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-localUpgrade maven-surefire-javadocUpgrade maven-install-plugin-javadocUpgrade maven-resolver-javadocUpgrade maven-doxia-module-foUpgrade maven-wagon-ssh-externalUpgrade maven-surefire-provider-testngUpgrade maven-plugin-plugin-bootstrapUpgrade os-maven-plugin-javadocUpgrade maven-artifact-managerUpgrade maven-doxia-module-xhtmlUpgrade maven-resources-plugin-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-javadoc-pluginUpgrade maven-common-artifact-filters-javadocUpgrade maven-surefireUpgrade maven-archiver-javadocUpgrade maven-file-managementUpgrade maven-assembly-plugin-javadocUpgrade maven-shared-ioUpgrade maven-resolver-utilUpgrade maven-plugin-annotationsUpgrade maven-dependency-pluginUpgrade maven-filtering-javadocUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-doxia-module-docbook-simpleUpgrade maven-jar-pluginUpgrade maven-enforcer-pluginUpgrade maven-javadoc-plugin-javadocUpgrade maven-assembly-pluginUpgrade maven-doxia-module-twikiUpgrade maven-doxia-module-fmlUpgrade maven-dependency-analyzer-javadocUpgrade maven-wagon-provider-apiUpgrade modello-maven-pluginUpgrade maven-resolver-named-locksUpgrade maven-reporting-apiUpgrade maven-projectUpgrade maven-plugin-tools-javadoc | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade libmaven3-core-java (Ubuntu Pro)Upgrade libmaven3-core-javaUpgrade mavenUpgrade maven (Ubuntu Pro) | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub