Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade maven | Jul 30, 2024 | Apr 23, 2021 |
| Freebsd | — | Upgrade maven | Nov 4, 2022 | Apr 19, 2021 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 34298772 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 34236279 for version 12.2.1.4.0. | Jul 25, 2022 | Apr 23, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 23, 2021 |
| Suse | — | Upgrade maven-javadoc-plugin-bootstrapUpgrade maven-jar-plugin-bootstrapUpgrade maven-wagon-httpUpgrade string-template-maven-pluginUpgrade maven-surefire-plugins-javadocUpgrade maven-plugin-pluginUpgrade maven-resolver-implUpgrade maven-wagon-ftpUpgrade maven-plugin-tools-javaUpgrade maven-doxia-coreUpgrade maven-doxia-module-xdocUpgrade maven-dependency-treeUpgrade gmavenplus-pluginUpgrade maven-artifact-resolver-javadocUpgrade maven-enforcer-javadocUpgrade maven-doxia-test-docsUpgrade maven-plugin-tools-generatorsUpgrade maven-plugin-bundle-javadocUpgrade maven-surefire-provider-junitUpgrade maven-install-pluginUpgrade maven-resolver-spiUpgrade modello-maven-plugin-javadocUpgrade maven-artifact-resolverUpgrade maven-shared-io-javadocUpgrade maven-doxia-module-confluenceUpgrade maven-clean-pluginUpgrade maven-jar-plugin-javadocUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-doxia-module-latexUpgrade hawtjni-maven-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade hawtjni-maven-pluginUpgrade maven-surefire-plugin-bootstrapUpgrade maven-plugin-registryUpgrade maven-wagon-http-lightweightUpgrade maven-toolchainUpgrade maven-plugin-tools-apiUpgrade maven-doxia-module-xhtml5Upgrade maven-mapping-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-monitorUpgrade maven-resolver-transport-wagonUpgrade maven-artifactUpgrade maven2-javadocUpgrade maven-mappingUpgrade maven-doxia-sitetoolsUpgrade maven-verifierUpgrade maven-compiler-plugin-javadocUpgrade mavenUpgrade maven-dependency-analyzerUpgrade bnd-maven-pluginUpgrade maven-invoker-javadocUpgrade xml-maven-plugin-javadocUpgrade maven-filteringUpgrade maven-remote-resources-plugin-javadocUpgrade maven-compiler-plugin-bootstrapUpgrade maven-wagon-ssh-commonUpgrade os-maven-pluginUpgrade maven-artifact-transferUpgrade maven-script-beanshellUpgrade antlr4-maven-pluginUpgrade maven-wagon-javadocUpgrade maven-plugin-tools-antUpgrade maven-doxia-logging-apiUpgrade maven-doxia-module-aptUpgrade maven-source-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade maven-libUpgrade maven-shared-utils-javadocUpgrade maven-invokerUpgrade maven-plugin-descriptorUpgrade maven-resolverUpgrade maven-resources-plugin-bootstrapUpgrade maven-plugin-bundleUpgrade maven-resolver-transport-fileUpgrade maven-resolver-test-utilUpgrade maven-enforcer-rulesUpgrade maven-script-antUpgrade maven-surefire-report-pluginUpgrade tesla-polyglot-maven-pluginUpgrade maven-wagon-http-sharedUpgrade maven-resolver-connector-basicUpgrade maven-wagon-sshUpgrade maven-jar-pluginUpgrade maven-resources-plugin-javadocUpgrade maven-resolver-named-locksUpgrade maven-doxia-module-twikiUpgrade maven-common-artifact-filters-javadocUpgrade maven-resolver-transport-classpathUpgrade maven-file-management-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-common-artifact-filtersUpgrade maven-doxia-module-rtfUpgrade maven-plugin-tools-javadocUpgrade maven-archiverUpgrade maven-plugin-tools-beanshellUpgrade xml-maven-pluginUpgrade maven-doxia-module-docbook-simpleUpgrade maven-dependency-analyzer-javadocUpgrade maven-wagon-provider-apiUpgrade maven-assembly-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-enforcer-pluginUpgrade modello-maven-pluginUpgrade maven-reporting-apiUpgrade maven-projectUpgrade maven-filtering-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-modelUpgrade maven-doxia-module-fmlUpgrade maven-javadoc-plugin-javadocUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-doxia-javadocUpgrade maven-resolver-transport-httpUpgrade javacc-maven-plugin-javadocUpgrade spec-version-maven-pluginUpgrade maven-compiler-pluginUpgrade maven-failsafe-pluginUpgrade maven-enforcerUpgrade string-template-maven-plugin-javadocUpgrade maven-settingsUpgrade maven-profileUpgrade maven-resolver-apiUpgrade paranamer-maven-pluginUpgrade maven-antrun-plugin-javadocUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-antrun-pluginUpgrade maven-dependency-pluginUpgrade maven-surefire-javadocUpgrade maven-shared-incremental-javadocUpgrade maven-resolver-utilUpgrade maven-plugin-plugin-bootstrapUpgrade maven-resolver-javadocUpgrade maven-install-plugin-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-clean-plugin-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-artifact-managerUpgrade maven-shared-utilsUpgrade maven-doxia-module-foUpgrade maven-surefireUpgrade exec-maven-plugin-javadocUpgrade javacc-maven-pluginUpgrade maven-surefire-report-parserUpgrade maven-test-toolsUpgrade maven-javadocUpgrade maven-shared-incrementalUpgrade maven-dependency-plugin-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-plugin-build-helper-javadocUpgrade maven-plugin-annotationsUpgrade maven-archiver-javadocUpgrade maven-localUpgrade maven-javadoc-pluginUpgrade maven-file-managementUpgrade maven-wagon-ssh-externalUpgrade os-maven-plugin-javadocUpgrade maven-wagon-fileUpgrade maven-surefire-provider-testngUpgrade maven-reporting-api-javadocUpgrade maven-shared-ioUpgrade bnd-maven-plugin-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-resources-pluginUpgrade spec-version-maven-plugin-javadocUpgrade maven-source-pluginUpgrade maven-plugin-testingUpgrade maven-dependency-tree-javadocUpgrade maven-surefire-pluginUpgrade maven-plugin-build-helperUpgrade maven-plugin-tools-modelUpgrade exec-maven-pluginUpgrade maven-doxia-sitetools-javadocUpgrade maven-verifier-javadocUpgrade maven-doxia-sink-apiUpgrade gmavenplus-plugin-javadocUpgrade maven-enforcer-api | Aug 9, 2024 | Apr 23, 2021 |
| Ubuntu | — | Upgrade mavenUpgrade libmaven3-core-javaUpgrade libmaven3-core-java (Ubuntu Pro)Upgrade maven (Ubuntu Pro) | Jan 16, 2023 | Apr 23, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2025 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub