Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-file-managementUpgrade maven-antrun-plugin-javadocUpgrade maven-antrun-pluginUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-settingsUpgrade maven-plugin-tools-beanshellUpgrade maven-profileUpgrade maven-resolver-apiUpgrade xml-maven-pluginUpgrade paranamer-maven-pluginUpgrade maven-archiverUpgrade javacc-maven-pluginUpgrade maven-surefire-report-parserUpgrade maven-plugin-testing-toolsUpgrade maven-test-toolsUpgrade maven-javadocUpgrade maven-doxia-module-rtfUpgrade maven-localUpgrade maven-resources-pluginUpgrade bnd-maven-plugin-javadocUpgrade maven-wagon-fileUpgrade maven-shared-incrementalUpgrade maven-plugin-testing-javadocUpgrade exec-maven-plugin-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-resolver-transport-classpathUpgrade maven-surefire-javadocUpgrade maven-doxia-module-foUpgrade string-template-maven-plugin-javadocUpgrade javacc-maven-plugin-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-clean-plugin-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-shared-incremental-javadocUpgrade maven-surefireUpgrade maven-plugin-plugin-bootstrapUpgrade maven-resolver-javadocUpgrade maven-shared-utilsUpgrade maven-install-plugin-javadocUpgrade maven-failsafe-pluginUpgrade maven-dependency-pluginUpgrade maven-resolver-utilUpgrade maven-artifact-managerUpgrade maven-resolver-transport-httpUpgrade maven-compiler-pluginUpgrade spec-version-maven-pluginUpgrade maven-surefire-provider-testngUpgrade maven-archiver-javadocUpgrade os-maven-plugin-javadocUpgrade maven-enforcerUpgrade maven-dependency-plugin-javadocUpgrade maven-reporting-api-javadocUpgrade maven-resources-plugin-javadocUpgrade maven-doxia-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-wagon-ssh-externalUpgrade maven-plugin-annotationsUpgrade maven-shared-ioUpgrade maven-javadoc-pluginUpgrade maven-doxia-sink-apiUpgrade maven-plugin-tools-javadocUpgrade exec-maven-pluginUpgrade spec-version-maven-plugin-javadocUpgrade maven-resolver-named-locksUpgrade gmavenplus-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-reporting-apiUpgrade maven-plugin-plugin-javadocUpgrade maven-dependency-tree-javadocUpgrade maven-file-management-javadocUpgrade maven-projectUpgrade maven-plugin-testingUpgrade maven-verifier-javadocUpgrade maven-doxia-module-docbook-simpleUpgrade maven-plugin-build-helperUpgrade maven-surefire-pluginUpgrade maven-dependency-analyzer-javadocUpgrade modello-maven-pluginUpgrade maven-enforcer-pluginUpgrade maven-plugin-tools-modelUpgrade maven-assembly-pluginUpgrade maven-jar-pluginUpgrade maven-doxia-module-twikiUpgrade maven-common-artifact-filtersUpgrade maven-doxia-sitetools-javadocUpgrade maven-modelUpgrade maven-source-pluginUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-doxia-module-fmlUpgrade maven-wagon-provider-apiUpgrade maven-filtering-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-plugin-testing-harnessUpgrade maven-javadoc-plugin-javadocUpgrade maven-resolver-test-utilUpgrade maven-doxia-module-xdocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-plugin-tools-antUpgrade maven2-javadocUpgrade maven-wagon-http-sharedUpgrade maven-artifactUpgrade maven-remote-resources-pluginUpgrade maven-wagon-javadocUpgrade maven-doxia-module-confluenceUpgrade maven-jar-plugin-javadocUpgrade maven-surefire-plugin-bootstrapUpgrade maven-script-antUpgrade maven-resources-plugin-bootstrapUpgrade maven-surefire-provider-junitUpgrade antlr4-maven-pluginUpgrade bnd-maven-pluginUpgrade maven-mappingUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-resolver-connector-basicUpgrade maven-dependency-analyzerUpgrade maven-artifact-resolverUpgrade maven-doxia-sitetoolsUpgrade modello-maven-plugin-javadocUpgrade mavenUpgrade maven-artifact-transfer-javadocUpgrade maven-plugin-bundle-javadocUpgrade maven-plugin-tools-generatorsUpgrade xml-maven-plugin-javadocUpgrade maven-doxia-coreUpgrade maven-shared-io-javadocUpgrade maven-resolver-spiUpgrade maven-plugin-tools-annotationsUpgrade maven-doxia-module-aptUpgrade maven-surefire-plugins-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-wagon-http-lightweightUpgrade maven-wagon-ftpUpgrade maven-resolver-implUpgrade maven-plugin-tools-javaUpgrade maven-resolverUpgrade maven-wagon-httpUpgrade hawtjni-maven-plugin-javadocUpgrade maven-script-beanshellUpgrade maven-plugin-descriptorUpgrade maven-clean-pluginUpgrade maven-compiler-plugin-javadocUpgrade maven-doxia-logging-apiUpgrade maven-doxia-module-xhtml5Upgrade maven-plugin-registryUpgrade maven-doxia-module-latexUpgrade os-maven-pluginUpgrade gmavenplus-pluginUpgrade maven-wagon-ssh-commonUpgrade hawtjni-maven-pluginUpgrade maven-plugin-pluginUpgrade maven-mapping-javadocUpgrade string-template-maven-pluginUpgrade maven-monitorUpgrade maven-resolver-transport-fileUpgrade maven-plugin-tools-apiUpgrade maven-remote-resources-plugin-javadocUpgrade maven-toolchainUpgrade maven-libUpgrade tesla-polyglot-maven-pluginUpgrade maven-verifierUpgrade maven-surefire-report-pluginUpgrade maven-invokerUpgrade maven-shared-utils-javadocUpgrade maven-wagon-sshUpgrade maven-source-plugin-javadocUpgrade maven-filteringUpgrade maven-install-pluginUpgrade maven-compiler-plugin-bootstrapUpgrade maven-enforcer-rulesUpgrade maven-artifact-resolver-javadocUpgrade maven-jar-plugin-bootstrapUpgrade maven-enforcer-javadocUpgrade maven-dependency-treeUpgrade maven-artifact-transferUpgrade maven-invoker-javadocUpgrade maven-plugin-bundleUpgrade maven-doxia-test-docs | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade libmaven3-core-java (Ubuntu Pro)Upgrade mavenUpgrade libmaven3-core-javaUpgrade maven (Ubuntu Pro) | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub