In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-openjdk17Upgrade apache-commons-ioUpgrade maven-wagonUpgrade slf4jUpgrade apache-commons-loggingUpgrade cdi-apiUpgrade plexus-containers-component-annotationsUpgrade maven-resolver-apiUpgrade plexus-sec-dispatcherUpgrade plexus-cipherUpgrade jansiUpgrade maven-libUpgrade apache-commons-cliUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade jcl-over-slf4jUpgrade jsr-305Upgrade sisu-plexusUpgrade apache-commons-codecUpgrade hawtjni-runtimeUpgrade maven-openjdk11Upgrade maven-resolver-connector-basicUpgrade maven-wagon-fileUpgrade sisuUpgrade jsoupUpgrade maven-wagon-http-sharedUpgrade guavaUpgrade jboss-interceptors-1.2-apiUpgrade sisu-injectUpgrade guava20Upgrade maven-shared-utilsUpgrade maven-wagon-provider-apiUpgrade maven-resolver-utilUpgrade httpcomponents-clientUpgrade maven-resolverUpgrade glassfish-el-apiUpgrade maven-resolver-implUpgrade maven-wagon-httpUpgrade geronimo-annotationUpgrade jansi-nativeUpgrade google-guiceUpgrade mavenUpgrade maven-resolver-spiUpgrade aopallianceUpgrade maven-resolver-transport-wagonUpgrade plexus-utilsUpgrade plexus-classworldsUpgrade httpcomponents-coreUpgrade atinjectUpgrade plexus-interpolation | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utils-javadocUpgrade maven-shared-utils | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade apache-commons-ioUpgrade geronimo-annotationUpgrade hawtjni-runtimeUpgrade sisu-injectUpgrade atinjectUpgrade jcl-over-slf4jUpgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade jsoupUpgrade maven-resolver-apiUpgrade maven-openjdk11Upgrade maven-resolver-connector-basicUpgrade maven-resolver-spiUpgrade jansi-nativeUpgrade maven-libUpgrade maven-openjdk8Upgrade google-guiceUpgrade mavenUpgrade plexus-interpolationUpgrade plexus-containers-component-annotationsUpgrade maven-resolverUpgrade jsr-305Upgrade maven-wagon-httpUpgrade plexus-classworldsUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade jboss-interceptors-1.2-apiUpgrade maven-resolver-transport-wagonUpgrade maven-wagonUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade aopallianceUpgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade guavaUpgrade maven-openjdk17Upgrade maven-shared-utils-javadocUpgrade sisu-plexusUpgrade slf4jUpgrade maven-resolver-implUpgrade maven-resolver-utilUpgrade maven-shared-utilsUpgrade plexus-cipherUpgrade httpcomponents-clientUpgrade jansiUpgrade sisuUpgrade plexus-utilsUpgrade plexus-sec-dispatcherUpgrade apache-commons-codecUpgrade guava20Upgrade cdi-api | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade maven-shared-utils-javadocUpgrade slf4jUpgrade apache-commons-codecUpgrade maven-openjdk17Upgrade jcl-over-slf4jUpgrade maven-openjdk11Upgrade hawtjni-runtimeUpgrade sisu-injectUpgrade apache-commons-lang3Upgrade jboss-interceptors-1.2-apiUpgrade maven-resolver-connector-basicUpgrade maven-resolver-transport-wagonUpgrade plexus-containers-component-annotationsUpgrade cdi-apiUpgrade glassfish-el-apiUpgrade maven-wagon-fileUpgrade plexus-sec-dispatcherUpgrade maven-resolver-implUpgrade httpcomponents-coreUpgrade maven-wagon-provider-apiUpgrade apache-commons-ioUpgrade plexus-utilsUpgrade jansiUpgrade sisuUpgrade plexus-cipherUpgrade maven-libUpgrade maven-wagonUpgrade jsr-305Upgrade guava20Upgrade apache-commons-cliUpgrade maven-wagon-httpUpgrade jansi-nativeUpgrade maven-resolverUpgrade mavenUpgrade maven-openjdk8Upgrade sisu-plexusUpgrade atinjectUpgrade guavaUpgrade maven-resolver-utilUpgrade apache-commons-loggingUpgrade httpcomponents-clientUpgrade google-guiceUpgrade plexus-classworldsUpgrade geronimo-annotationUpgrade maven-shared-utilsUpgrade maven-resolver-apiUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade jsoupUpgrade maven-wagon-http-sharedUpgrade aopalliance | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade geronimo-annotationUpgrade maven-openjdk17Upgrade plexus-classworldsUpgrade guavaUpgrade hawtjni-runtimeUpgrade glassfish-el-apiUpgrade apache-commons-lang3Upgrade maven-resolver-utilUpgrade plexus-sec-dispatcherUpgrade maven-wagonUpgrade maven-libUpgrade apache-commons-ioUpgrade mavenUpgrade jsoupUpgrade cdi-apiUpgrade jcl-over-slf4jUpgrade maven-resolver-connector-basicUpgrade sisu-plexusUpgrade maven-shared-utils-javadocUpgrade plexus-cipherUpgrade plexus-interpolationUpgrade jsr-305Upgrade maven-resolver-implUpgrade maven-openjdk8Upgrade maven-wagon-fileUpgrade maven-wagon-http-sharedUpgrade sisuUpgrade maven-resolver-apiUpgrade maven-openjdk11Upgrade atinjectUpgrade maven-resolver-transport-wagonUpgrade jansiUpgrade maven-wagon-httpUpgrade slf4jUpgrade aopallianceUpgrade maven-resolver-spiUpgrade maven-shared-utilsUpgrade httpcomponents-coreUpgrade apache-commons-codecUpgrade maven-resolverUpgrade jboss-interceptors-1.2-apiUpgrade guava20Upgrade apache-commons-loggingUpgrade maven-wagon-provider-apiUpgrade sisu-injectUpgrade google-guiceUpgrade plexus-containers-component-annotationsUpgrade httpcomponents-clientUpgrade jansi-nativeUpgrade apache-commons-cliUpgrade plexus-utils | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-resolver-transport-classpathUpgrade maven-artifact-managerUpgrade maven-doxia-module-aptUpgrade maven-jar-pluginUpgrade maven-doxia-sitetools-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-reporting-apiUpgrade maven-plugin-plugin-javadocUpgrade maven-install-plugin-javadocUpgrade maven-surefireUpgrade maven-surefire-pluginUpgrade maven-resolver-utilUpgrade maven-plugin-plugin-bootstrapUpgrade maven-wagon-fileUpgrade maven-surefire-report-parserUpgrade maven-assembly-pluginUpgrade maven-plugin-annotationsUpgrade maven-clean-pluginUpgrade maven-antrun-plugin-javadocUpgrade maven-file-management-javadocUpgrade maven-clean-plugin-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-plugin-tools-antUpgrade maven-archiverUpgrade maven-resolver-implUpgrade maven-file-managementUpgrade maven-dependency-tree-javadocUpgrade maven-plugin-testingUpgrade maven-enforcerUpgrade maven-reporting-api-javadocUpgrade maven-source-pluginUpgrade maven-shared-incrementalUpgrade maven-resolver-transport-wagonUpgrade os-maven-pluginUpgrade maven-wagon-javadocUpgrade maven-wagon-ssh-externalUpgrade maven-remote-resources-pluginUpgrade exec-maven-plugin-javadocUpgrade maven-plugin-tools-javadocUpgrade maven-javadoc-plugin-javadocUpgrade maven-dependency-pluginUpgrade gmavenplus-pluginUpgrade maven-shared-ioUpgrade spec-version-maven-pluginUpgrade maven-shared-utilsUpgrade spec-version-maven-plugin-javadocUpgrade maven-enforcer-pluginUpgrade maven-mapping-javadocUpgrade maven-profileUpgrade maven-modelUpgrade maven-projectUpgrade maven-doxia-module-twikiUpgrade javacc-maven-pluginUpgrade maven-plugin-tools-apiUpgrade maven-plugin-bundleUpgrade maven-shared-incremental-javadocUpgrade maven-resources-pluginUpgrade maven-common-artifact-filters-javadocUpgrade maven-failsafe-pluginUpgrade maven-resolver-transport-httpUpgrade maven-doxia-module-foUpgrade maven-plugin-testing-harnessUpgrade string-template-maven-pluginUpgrade xml-maven-pluginUpgrade modello-maven-pluginUpgrade maven-doxia-javadocUpgrade maven-surefire-plugins-javadocUpgrade maven-javadoc-pluginUpgrade maven-enforcer-apiUpgrade maven-doxia-logging-apiUpgrade maven-artifact-transfer-javadocUpgrade maven-plugin-build-helper-javadocUpgrade javacc-maven-plugin-javadocUpgrade maven-plugin-bundle-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-doxia-sink-apiUpgrade maven-plugin-testing-toolsUpgrade maven-wagon-http-lightweightUpgrade maven-common-artifact-filtersUpgrade paranamer-maven-pluginUpgrade maven-doxia-coreUpgrade maven-wagon-http-sharedUpgrade maven-archiver-javadocUpgrade maven-localUpgrade maven-doxia-module-rtfUpgrade maven2-javadocUpgrade maven-plugin-descriptorUpgrade maven-libUpgrade maven-verifier-javadocUpgrade os-maven-plugin-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-resolver-connector-basicUpgrade gmavenplus-plugin-javadocUpgrade maven-artifact-transferUpgrade maven-surefire-plugin-bootstrapUpgrade maven-settingsUpgrade maven-script-beanshellUpgrade maven-plugin-tools-beanshellUpgrade antlr4-maven-pluginUpgrade xml-maven-plugin-javadocUpgrade maven-compiler-pluginUpgrade mavenUpgrade maven-doxia-module-confluenceUpgrade maven-toolchainUpgrade maven-filtering-javadocUpgrade bnd-maven-pluginUpgrade maven-doxia-module-latexUpgrade maven-enforcer-rulesUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-install-pluginUpgrade maven-plugin-pluginUpgrade maven-verifierUpgrade maven-surefire-report-pluginUpgrade maven-shared-utils-javadocUpgrade maven-resources-plugin-javadocUpgrade maven-resolver-test-utilUpgrade maven-doxia-module-docbook-simpleUpgrade maven-artifact-resolverUpgrade maven-dependency-analyzerUpgrade maven-antrun-pluginUpgrade modello-maven-plugin-javadocUpgrade maven-wagon-sshUpgrade maven-resolver-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-monitorUpgrade maven-invoker-javadocUpgrade maven-filteringUpgrade maven-doxia-test-docsUpgrade maven-doxia-module-xhtml5Upgrade maven-doxia-module-xhtmlUpgrade maven-shared-io-javadocUpgrade maven-invokerUpgrade maven-surefire-provider-junitUpgrade maven-surefire-javadocUpgrade maven-resolver-apiUpgrade maven-plugin-tools-annotationsUpgrade maven-javadocUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-compiler-plugin-javadocUpgrade maven-compiler-plugin-bootstrapUpgrade bnd-maven-plugin-javadocUpgrade maven-resolver-spiUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-dependency-analyzer-javadocUpgrade maven-plugin-tools-modelUpgrade tesla-polyglot-maven-pluginUpgrade maven-mappingUpgrade maven-plugin-registryUpgrade maven-doxia-module-fmlUpgrade maven-wagon-ssh-commonUpgrade maven-artifact-resolver-javadocUpgrade hawtjni-maven-pluginUpgrade maven-wagon-provider-apiUpgrade maven-plugin-tools-javaUpgrade maven-wagon-httpUpgrade maven-test-toolsUpgrade string-template-maven-plugin-javadocUpgrade maven-wagon-ftpUpgrade maven-resources-plugin-bootstrapUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-doxia-module-xdocUpgrade maven-resolver-transport-fileUpgrade maven-surefire-provider-testngUpgrade maven-jar-plugin-bootstrapUpgrade maven-dependency-treeUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-plugin-build-helperUpgrade maven-jar-plugin-javadocUpgrade maven-source-plugin-javadocUpgrade maven-resolverUpgrade maven-script-antUpgrade maven-resolver-named-locksUpgrade maven-enforcer-javadocUpgrade hawtjni-maven-plugin-javadocUpgrade exec-maven-pluginUpgrade maven-artifact | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub