In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-resolver-connector-basicUpgrade maven-wagonUpgrade jcl-over-slf4jUpgrade hawtjni-runtimeUpgrade maven-resolver-apiUpgrade plexus-sec-dispatcherUpgrade maven-openjdk11Upgrade maven-wagon-fileUpgrade cdi-apiUpgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade maven-openjdk17Upgrade jansiUpgrade sisuUpgrade maven-libUpgrade apache-commons-codecUpgrade slf4jUpgrade apache-commons-ioUpgrade plexus-cipherUpgrade maven-openjdk8Upgrade apache-commons-lang3Upgrade sisu-plexusUpgrade plexus-containers-component-annotationsUpgrade jsr-305Upgrade maven-resolverUpgrade maven-resolver-utilUpgrade guavaUpgrade plexus-utilsUpgrade aopallianceUpgrade httpcomponents-coreUpgrade maven-wagon-httpUpgrade guava20Upgrade maven-wagon-provider-apiUpgrade jsoupUpgrade atinjectUpgrade glassfish-el-apiUpgrade sisu-injectUpgrade mavenUpgrade plexus-interpolationUpgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade maven-resolver-implUpgrade jansi-nativeUpgrade geronimo-annotationUpgrade google-guiceUpgrade maven-wagon-http-sharedUpgrade maven-resolver-transport-wagonUpgrade plexus-classworldsUpgrade maven-resolver-spiUpgrade httpcomponents-client | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utilsUpgrade maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade apache-commons-loggingUpgrade google-guiceUpgrade maven-wagon-httpUpgrade jsr-305Upgrade plexus-classworldsUpgrade sisu-injectUpgrade apache-commons-lang3Upgrade maven-resolver-connector-basicUpgrade httpcomponents-coreUpgrade apache-commons-cliUpgrade apache-commons-ioUpgrade jansi-nativeUpgrade atinjectUpgrade geronimo-annotationUpgrade hawtjni-runtimeUpgrade jsoupUpgrade maven-libUpgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade maven-openjdk8Upgrade jcl-over-slf4jUpgrade maven-resolverUpgrade maven-resolver-apiUpgrade mavenUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk11Upgrade sisuUpgrade maven-wagon-provider-apiUpgrade maven-resolver-implUpgrade slf4jUpgrade guava20Upgrade jansiUpgrade httpcomponents-clientUpgrade plexus-cipherUpgrade maven-openjdk17Upgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade maven-wagonUpgrade apache-commons-codecUpgrade plexus-utilsUpgrade plexus-sec-dispatcherUpgrade guavaUpgrade maven-wagon-http-sharedUpgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade aopallianceUpgrade cdi-apiUpgrade sisu-plexusUpgrade maven-resolver-transport-wagonUpgrade maven-shared-utils-javadocUpgrade maven-resolver-util | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade plexus-containers-component-annotationsUpgrade apache-commons-ioUpgrade cdi-apiUpgrade jsr-305Upgrade maven-wagonUpgrade glassfish-el-apiUpgrade plexus-sec-dispatcherUpgrade maven-resolver-connector-basicUpgrade httpcomponents-coreUpgrade maven-resolver-transport-wagonUpgrade jcl-over-slf4jUpgrade sisuUpgrade slf4jUpgrade plexus-cipherUpgrade maven-libUpgrade maven-wagon-fileUpgrade apache-commons-codecUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade maven-shared-utils-javadocUpgrade plexus-utilsUpgrade jansiUpgrade maven-resolver-implUpgrade maven-openjdk17Upgrade maven-wagon-provider-apiUpgrade sisu-injectUpgrade maven-openjdk11Upgrade jboss-interceptors-1.2-apiUpgrade sisu-plexusUpgrade maven-wagon-http-sharedUpgrade google-guiceUpgrade maven-resolver-apiUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade maven-shared-utilsUpgrade aopallianceUpgrade atinjectUpgrade plexus-classworldsUpgrade geronimo-annotationUpgrade apache-commons-cliUpgrade maven-wagon-httpUpgrade maven-openjdk8Upgrade httpcomponents-clientUpgrade guavaUpgrade maven-resolver-utilUpgrade apache-commons-loggingUpgrade guava20Upgrade maven-resolverUpgrade mavenUpgrade jansi-nativeUpgrade jsoup | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade glassfish-el-apiUpgrade guavaUpgrade apache-commons-lang3Upgrade plexus-sec-dispatcherUpgrade maven-libUpgrade maven-wagon-http-sharedUpgrade jsr-305Upgrade geronimo-annotationUpgrade maven-resolver-utilUpgrade maven-resolver-implUpgrade sisu-plexusUpgrade maven-wagonUpgrade hawtjni-runtimeUpgrade plexus-classworldsUpgrade maven-openjdk17Upgrade plexus-interpolationUpgrade jsoupUpgrade mavenUpgrade maven-openjdk8Upgrade jcl-over-slf4jUpgrade maven-resolver-connector-basicUpgrade sisuUpgrade cdi-apiUpgrade maven-openjdk11Upgrade maven-shared-utils-javadocUpgrade maven-wagon-fileUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade apache-commons-ioUpgrade guava20Upgrade aopallianceUpgrade apache-commons-cliUpgrade maven-shared-utilsUpgrade apache-commons-codecUpgrade maven-resolverUpgrade jansi-nativeUpgrade apache-commons-loggingUpgrade slf4jUpgrade sisu-injectUpgrade maven-wagon-httpUpgrade maven-wagon-provider-apiUpgrade httpcomponents-clientUpgrade google-guiceUpgrade plexus-containers-component-annotationsUpgrade httpcomponents-coreUpgrade maven-resolver-spiUpgrade jboss-interceptors-1.2-apiUpgrade jansiUpgrade atinjectUpgrade plexus-utilsUpgrade maven-resolver-transport-wagon | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-plugin-tools-modelUpgrade maven-plugin-registryUpgrade maven-doxia-module-fmlUpgrade maven-surefire-javadocUpgrade maven-dependency-treeUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-compiler-plugin-javadocUpgrade maven-libUpgrade maven-plugin-descriptorUpgrade maven-resolverUpgrade maven-verifier-javadocUpgrade maven-artifactUpgrade maven-plugin-tools-beanshellUpgrade maven-dependency-analyzer-javadocUpgrade maven-artifact-resolver-javadocUpgrade maven-resolver-spiUpgrade maven-doxia-module-latexUpgrade maven-doxia-module-confluenceUpgrade maven-javadoc-plugin-bootstrapUpgrade bnd-maven-pluginUpgrade maven-enforcer-rulesUpgrade maven-install-pluginUpgrade maven-toolchainUpgrade maven-filtering-javadocUpgrade maven-plugin-pluginUpgrade maven-source-plugin-javadocUpgrade maven-resolver-test-utilUpgrade maven-resolver-named-locksUpgrade maven-doxia-test-docsUpgrade maven-antrun-pluginUpgrade maven-script-antUpgrade maven2-javadocUpgrade maven-resources-plugin-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-shared-utils-javadocUpgrade maven-verifierUpgrade maven-wagon-sshUpgrade maven-artifact-resolverUpgrade maven-resolver-javadocUpgrade maven-invoker-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-monitorUpgrade maven-doxia-module-xhtml5Upgrade maven-filteringUpgrade maven-dependency-analyzerUpgrade maven-surefire-report-pluginUpgrade maven-doxia-module-docbook-simpleUpgrade exec-maven-pluginUpgrade maven-surefire-plugin-bootstrapUpgrade maven-resources-plugin-bootstrapUpgrade antlr4-maven-pluginUpgrade maven-surefire-provider-junit5Upgrade gmavenplus-plugin-javadocUpgrade maven-remote-resources-plugin-javadocUpgrade string-template-maven-plugin-javadocUpgrade maven-wagon-ftpUpgrade xml-maven-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-script-beanshellUpgrade maven-surefire-provider-junitUpgrade maven-plugin-build-helperUpgrade maven-resolver-apiUpgrade maven-resolver-transport-fileUpgrade maven-javadocUpgrade maven-shared-io-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-enforcer-javadocUpgrade maven-invokerUpgrade maven-doxia-module-xhtmlUpgrade maven-compiler-plugin-bootstrapUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-compiler-pluginUpgrade maven-wagon-ssh-commonUpgrade maven-jar-plugin-javadocUpgrade tesla-polyglot-maven-pluginUpgrade maven-wagon-httpUpgrade maven-settingsUpgrade maven-mappingUpgrade hawtjni-maven-pluginUpgrade maven-jar-plugin-bootstrapUpgrade maven-resolver-connector-basicUpgrade maven-artifact-transferUpgrade maven-wagon-provider-apiUpgrade mavenUpgrade maven-test-toolsUpgrade maven-doxia-sitetoolsUpgrade maven-doxia-module-xdocUpgrade maven-plugin-tools-javaUpgrade maven-surefire-provider-testngUpgrade hawtjni-maven-plugin-javadocUpgrade bnd-maven-plugin-javadocUpgrade modello-maven-pluginUpgrade maven-javadoc-pluginUpgrade maven-jar-pluginUpgrade maven-plugin-tools-antUpgrade maven-shared-incrementalUpgrade maven-reporting-api-javadocUpgrade maven-doxia-module-rtfUpgrade maven-clean-plugin-javadocUpgrade maven-javadoc-plugin-javadocUpgrade maven-resolver-transport-classpathUpgrade maven-plugin-annotationsUpgrade paranamer-maven-pluginUpgrade maven-resolver-utilUpgrade maven-wagon-ssh-externalUpgrade maven-surefire-report-parserUpgrade maven-failsafe-pluginUpgrade maven-plugin-bundleUpgrade maven-archiver-javadocUpgrade maven-artifact-transfer-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-projectUpgrade maven-reporting-apiUpgrade maven-doxia-sitetools-javadocUpgrade maven-artifact-managerUpgrade maven-doxia-coreUpgrade maven-plugin-plugin-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-doxia-module-twikiUpgrade maven-shared-incremental-javadocUpgrade maven-dependency-tree-javadocUpgrade maven-shared-utilsUpgrade maven-surefire-pluginUpgrade maven-shared-ioUpgrade maven-plugin-bundle-javadocUpgrade maven-doxia-module-aptUpgrade maven-antrun-plugin-javadocUpgrade maven-profileUpgrade maven-modelUpgrade maven-plugin-testing-toolsUpgrade maven-localUpgrade maven-plugin-testingUpgrade maven-file-management-javadocUpgrade maven-doxia-module-foUpgrade maven-archiverUpgrade maven-file-managementUpgrade exec-maven-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade os-maven-pluginUpgrade maven-resolver-transport-wagonUpgrade spec-version-maven-plugin-javadocUpgrade maven-source-pluginUpgrade javacc-maven-pluginUpgrade maven-resolver-transport-httpUpgrade maven-plugin-build-helper-javadocUpgrade maven-doxia-javadocUpgrade maven-doxia-logging-apiUpgrade xml-maven-pluginUpgrade maven-wagon-fileUpgrade maven-plugin-tools-apiUpgrade maven-plugin-tools-javadocUpgrade maven-mapping-javadocUpgrade maven-dependency-pluginUpgrade spec-version-maven-pluginUpgrade maven-wagon-http-lightweightUpgrade gmavenplus-pluginUpgrade maven-wagon-http-sharedUpgrade maven-doxia-sink-apiUpgrade maven-wagon-javadocUpgrade maven-surefireUpgrade maven-resources-pluginUpgrade maven-common-artifact-filtersUpgrade maven-install-plugin-javadocUpgrade maven-enforcer-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-resolver-implUpgrade maven-surefire-plugins-javadocUpgrade maven-plugin-testing-harnessUpgrade maven-enforcer-apiUpgrade maven-enforcerUpgrade maven-dependency-plugin-javadocUpgrade maven-assembly-pluginUpgrade maven-assembly-plugin-javadocUpgrade javacc-maven-plugin-javadocUpgrade maven-clean-pluginUpgrade string-template-maven-plugin | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub