In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-aopalliancealma-upgrade-apache-commons-clialma-upgrade-apache-commons-codecalma-upgrade-apache-commons-ioalma-upgrade-apache-commons-lang3alma-upgrade-apache-commons-loggingalma-upgrade-atinjectalma-upgrade-cdi-apialma-upgrade-geronimo-annotationalma-upgrade-glassfish-el-apialma-upgrade-google-guicealma-upgrade-guavaalma-upgrade-guava20alma-upgrade-hawtjni-runtimealma-upgrade-httpcomponents-clientalma-upgrade-httpcomponents-corealma-upgrade-jansialma-upgrade-jansi-nativealma-upgrade-jboss-interceptors-1.2-apialma-upgrade-jcl-over-slf4jalma-upgrade-jsoupalma-upgrade-jsr-305alma-upgrade-mavenalma-upgrade-maven-libalma-upgrade-maven-openjdk11alma-upgrade-maven-openjdk17alma-upgrade-maven-openjdk8alma-upgrade-maven-resolveralma-upgrade-maven-resolver-apialma-upgrade-maven-resolver-connector-basicalma-upgrade-maven-resolver-implalma-upgrade-maven-resolver-spialma-upgrade-maven-resolver-transport-wagonalma-upgrade-maven-resolver-utilalma-upgrade-maven-shared-utilsalma-upgrade-maven-wagonalma-upgrade-maven-wagon-filealma-upgrade-maven-wagon-httpalma-upgrade-maven-wagon-http-sharedalma-upgrade-maven-wagon-provider-apialma-upgrade-plexus-cipheralma-upgrade-plexus-classworldsalma-upgrade-plexus-containers-component-annotationsalma-upgrade-plexus-interpolationalma-upgrade-plexus-sec-dispatcheralma-upgrade-plexus-utilsalma-upgrade-sisualma-upgrade-sisu-injectalma-upgrade-sisu-plexusalma-upgrade-slf4j | Jun 7, 2022 | May 23, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-maven-shared-utilsamazon-linux-ami-2-upgrade-maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 | |
| Centos_linux | — | centos-upgrade-aopalliancecentos-upgrade-apache-commons-clicentos-upgrade-apache-commons-codeccentos-upgrade-apache-commons-iocentos-upgrade-apache-commons-lang3centos-upgrade-apache-commons-loggingcentos-upgrade-atinjectcentos-upgrade-cdi-apicentos-upgrade-geronimo-annotationcentos-upgrade-glassfish-el-apicentos-upgrade-google-guicecentos-upgrade-guavacentos-upgrade-guava20centos-upgrade-hawtjni-runtimecentos-upgrade-httpcomponents-clientcentos-upgrade-httpcomponents-corecentos-upgrade-jansicentos-upgrade-jansi-nativecentos-upgrade-jboss-interceptors-1-2-apicentos-upgrade-jcl-over-slf4jcentos-upgrade-jsoupcentos-upgrade-jsr-305centos-upgrade-mavencentos-upgrade-maven-libcentos-upgrade-maven-openjdk11centos-upgrade-maven-openjdk17centos-upgrade-maven-openjdk8centos-upgrade-maven-resolvercentos-upgrade-maven-resolver-apicentos-upgrade-maven-resolver-connector-basiccentos-upgrade-maven-resolver-implcentos-upgrade-maven-resolver-spicentos-upgrade-maven-resolver-transport-wagoncentos-upgrade-maven-resolver-utilcentos-upgrade-maven-shared-utilscentos-upgrade-maven-shared-utils-javadoccentos-upgrade-maven-wagoncentos-upgrade-maven-wagon-filecentos-upgrade-maven-wagon-httpcentos-upgrade-maven-wagon-http-sharedcentos-upgrade-maven-wagon-provider-apicentos-upgrade-plexus-ciphercentos-upgrade-plexus-classworldscentos-upgrade-plexus-containers-component-annotationscentos-upgrade-plexus-interpolationcentos-upgrade-plexus-sec-dispatchercentos-upgrade-plexus-utilscentos-upgrade-sisucentos-upgrade-sisu-injectcentos-upgrade-sisu-plexuscentos-upgrade-slf4j | May 2, 2022 | Apr 26, 2022 |
| Debian | debian-upgrade-maven-shared-utils | Jun 28, 2022 | May 23, 2022 | |
| Oracle Weblogic | oracle-weblogic-oct-2023-cpu-14_1_1_0_0 | Oct 19, 2023 | May 23, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-aopallianceoracle-linux-upgrade-apache-commons-clioracle-linux-upgrade-apache-commons-codecoracle-linux-upgrade-apache-commons-iooracle-linux-upgrade-apache-commons-lang3oracle-linux-upgrade-apache-commons-loggingoracle-linux-upgrade-atinjectoracle-linux-upgrade-cdi-apioracle-linux-upgrade-geronimo-annotationoracle-linux-upgrade-glassfish-el-apioracle-linux-upgrade-google-guiceoracle-linux-upgrade-guavaoracle-linux-upgrade-guava20oracle-linux-upgrade-hawtjni-runtimeoracle-linux-upgrade-httpcomponents-clientoracle-linux-upgrade-httpcomponents-coreoracle-linux-upgrade-jansioracle-linux-upgrade-jansi-nativeoracle-linux-upgrade-jboss-interceptors-1-2-apioracle-linux-upgrade-jcl-over-slf4joracle-linux-upgrade-jsouporacle-linux-upgrade-jsr-305oracle-linux-upgrade-mavenoracle-linux-upgrade-maven-liboracle-linux-upgrade-maven-openjdk11oracle-linux-upgrade-maven-openjdk17oracle-linux-upgrade-maven-openjdk8oracle-linux-upgrade-maven-resolveroracle-linux-upgrade-maven-resolver-apioracle-linux-upgrade-maven-resolver-connector-basicoracle-linux-upgrade-maven-resolver-imploracle-linux-upgrade-maven-resolver-spioracle-linux-upgrade-maven-resolver-transport-wagonoracle-linux-upgrade-maven-resolver-utiloracle-linux-upgrade-maven-shared-utilsoracle-linux-upgrade-maven-shared-utils-javadocoracle-linux-upgrade-maven-wagonoracle-linux-upgrade-maven-wagon-fileoracle-linux-upgrade-maven-wagon-httporacle-linux-upgrade-maven-wagon-http-sharedoracle-linux-upgrade-maven-wagon-provider-apioracle-linux-upgrade-plexus-cipheroracle-linux-upgrade-plexus-classworldsoracle-linux-upgrade-plexus-containers-component-annotationsoracle-linux-upgrade-plexus-interpolationoracle-linux-upgrade-plexus-sec-dispatcheroracle-linux-upgrade-plexus-utilsoracle-linux-upgrade-sisuoracle-linux-upgrade-sisu-injectoracle-linux-upgrade-sisu-plexusoracle-linux-upgrade-slf4j | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | linuxrpm-upgrade-jenkins-2-plugins | Jan 5, 2023 | May 23, 2022 | |
| Redhat_linux | redhat-upgrade-aopallianceredhat-upgrade-apache-commons-cliredhat-upgrade-apache-commons-codecredhat-upgrade-apache-commons-ioredhat-upgrade-apache-commons-lang3redhat-upgrade-apache-commons-loggingredhat-upgrade-atinjectredhat-upgrade-cdi-apiredhat-upgrade-geronimo-annotationredhat-upgrade-glassfish-el-apiredhat-upgrade-google-guiceredhat-upgrade-guavaredhat-upgrade-guava20redhat-upgrade-hawtjni-runtimeredhat-upgrade-httpcomponents-clientredhat-upgrade-httpcomponents-coreredhat-upgrade-jansiredhat-upgrade-jansi-nativeredhat-upgrade-jboss-interceptors-1-2-apiredhat-upgrade-jcl-over-slf4jredhat-upgrade-jsoupredhat-upgrade-jsr-305redhat-upgrade-mavenredhat-upgrade-maven-libredhat-upgrade-maven-openjdk11redhat-upgrade-maven-openjdk17redhat-upgrade-maven-openjdk8redhat-upgrade-maven-resolverredhat-upgrade-maven-resolver-apiredhat-upgrade-maven-resolver-connector-basicredhat-upgrade-maven-resolver-implredhat-upgrade-maven-resolver-spiredhat-upgrade-maven-resolver-transport-wagonredhat-upgrade-maven-resolver-utilredhat-upgrade-maven-shared-utilsredhat-upgrade-maven-shared-utils-javadocredhat-upgrade-maven-wagonredhat-upgrade-maven-wagon-fileredhat-upgrade-maven-wagon-httpredhat-upgrade-maven-wagon-http-sharedredhat-upgrade-maven-wagon-provider-apiredhat-upgrade-plexus-cipherredhat-upgrade-plexus-classworldsredhat-upgrade-plexus-containers-component-annotationsredhat-upgrade-plexus-interpolationredhat-upgrade-plexus-sec-dispatcherredhat-upgrade-plexus-utilsredhat-upgrade-sisuredhat-upgrade-sisu-injectredhat-upgrade-sisu-plexusredhat-upgrade-slf4j | May 2, 2022 | Apr 26, 2022 | |
| Rocky_linux | rocky-upgrade-jansi-native | Mar 12, 2024 | May 23, 2022 | |
| Suse | — | suse-upgrade-antlr4-maven-pluginsuse-upgrade-bnd-maven-pluginsuse-upgrade-bnd-maven-plugin-javadocsuse-upgrade-exec-maven-pluginsuse-upgrade-exec-maven-plugin-javadocsuse-upgrade-gmavenplus-pluginsuse-upgrade-gmavenplus-plugin-javadocsuse-upgrade-hawtjni-maven-pluginsuse-upgrade-hawtjni-maven-plugin-javadocsuse-upgrade-javacc-maven-pluginsuse-upgrade-javacc-maven-plugin-javadocsuse-upgrade-mavensuse-upgrade-maven-antrun-pluginsuse-upgrade-maven-antrun-plugin-javadocsuse-upgrade-maven-archiversuse-upgrade-maven-archiver-javadocsuse-upgrade-maven-artifactsuse-upgrade-maven-artifact-managersuse-upgrade-maven-artifact-resolversuse-upgrade-maven-artifact-resolver-javadocsuse-upgrade-maven-artifact-transfersuse-upgrade-maven-artifact-transfer-javadocsuse-upgrade-maven-assembly-pluginsuse-upgrade-maven-assembly-plugin-javadocsuse-upgrade-maven-clean-pluginsuse-upgrade-maven-clean-plugin-javadocsuse-upgrade-maven-common-artifact-filterssuse-upgrade-maven-common-artifact-filters-javadocsuse-upgrade-maven-compiler-pluginsuse-upgrade-maven-compiler-plugin-bootstrapsuse-upgrade-maven-compiler-plugin-javadocsuse-upgrade-maven-dependency-analyzersuse-upgrade-maven-dependency-analyzer-javadocsuse-upgrade-maven-dependency-pluginsuse-upgrade-maven-dependency-plugin-javadocsuse-upgrade-maven-dependency-treesuse-upgrade-maven-dependency-tree-javadocsuse-upgrade-maven-doxia-coresuse-upgrade-maven-doxia-javadocsuse-upgrade-maven-doxia-logging-apisuse-upgrade-maven-doxia-module-aptsuse-upgrade-maven-doxia-module-confluencesuse-upgrade-maven-doxia-module-docbook-simplesuse-upgrade-maven-doxia-module-fmlsuse-upgrade-maven-doxia-module-fosuse-upgrade-maven-doxia-module-latexsuse-upgrade-maven-doxia-module-rtfsuse-upgrade-maven-doxia-module-twikisuse-upgrade-maven-doxia-module-xdocsuse-upgrade-maven-doxia-module-xhtmlsuse-upgrade-maven-doxia-module-xhtml5suse-upgrade-maven-doxia-sink-apisuse-upgrade-maven-doxia-sitetoolssuse-upgrade-maven-doxia-sitetools-javadocsuse-upgrade-maven-doxia-test-docssuse-upgrade-maven-enforcersuse-upgrade-maven-enforcer-apisuse-upgrade-maven-enforcer-javadocsuse-upgrade-maven-enforcer-pluginsuse-upgrade-maven-enforcer-rulessuse-upgrade-maven-failsafe-pluginsuse-upgrade-maven-failsafe-plugin-bootstrapsuse-upgrade-maven-file-managementsuse-upgrade-maven-file-management-javadocsuse-upgrade-maven-filteringsuse-upgrade-maven-filtering-javadocsuse-upgrade-maven-install-pluginsuse-upgrade-maven-install-plugin-javadocsuse-upgrade-maven-invokersuse-upgrade-maven-invoker-javadocsuse-upgrade-maven-jar-pluginsuse-upgrade-maven-jar-plugin-bootstrapsuse-upgrade-maven-jar-plugin-javadocsuse-upgrade-maven-javadocsuse-upgrade-maven-javadoc-pluginsuse-upgrade-maven-javadoc-plugin-bootstrapsuse-upgrade-maven-javadoc-plugin-javadocsuse-upgrade-maven-libsuse-upgrade-maven-localsuse-upgrade-maven-mappingsuse-upgrade-maven-mapping-javadocsuse-upgrade-maven-modelsuse-upgrade-maven-monitorsuse-upgrade-maven-plugin-annotationssuse-upgrade-maven-plugin-build-helpersuse-upgrade-maven-plugin-build-helper-javadocsuse-upgrade-maven-plugin-bundlesuse-upgrade-maven-plugin-bundle-javadocsuse-upgrade-maven-plugin-descriptorsuse-upgrade-maven-plugin-pluginsuse-upgrade-maven-plugin-plugin-bootstrapsuse-upgrade-maven-plugin-plugin-javadocsuse-upgrade-maven-plugin-registrysuse-upgrade-maven-plugin-testingsuse-upgrade-maven-plugin-testing-harnesssuse-upgrade-maven-plugin-testing-javadocsuse-upgrade-maven-plugin-testing-toolssuse-upgrade-maven-plugin-tools-annotationssuse-upgrade-maven-plugin-tools-antsuse-upgrade-maven-plugin-tools-apisuse-upgrade-maven-plugin-tools-beanshellsuse-upgrade-maven-plugin-tools-generatorssuse-upgrade-maven-plugin-tools-javasuse-upgrade-maven-plugin-tools-javadocsuse-upgrade-maven-plugin-tools-modelsuse-upgrade-maven-profilesuse-upgrade-maven-projectsuse-upgrade-maven-remote-resources-pluginsuse-upgrade-maven-remote-resources-plugin-javadocsuse-upgrade-maven-reporting-apisuse-upgrade-maven-reporting-api-javadocsuse-upgrade-maven-resolversuse-upgrade-maven-resolver-apisuse-upgrade-maven-resolver-connector-basicsuse-upgrade-maven-resolver-implsuse-upgrade-maven-resolver-javadocsuse-upgrade-maven-resolver-named-lockssuse-upgrade-maven-resolver-spisuse-upgrade-maven-resolver-test-utilsuse-upgrade-maven-resolver-transport-classpathsuse-upgrade-maven-resolver-transport-filesuse-upgrade-maven-resolver-transport-httpsuse-upgrade-maven-resolver-transport-wagonsuse-upgrade-maven-resolver-utilsuse-upgrade-maven-resources-pluginsuse-upgrade-maven-resources-plugin-bootstrapsuse-upgrade-maven-resources-plugin-javadocsuse-upgrade-maven-script-antsuse-upgrade-maven-script-beanshellsuse-upgrade-maven-settingssuse-upgrade-maven-shared-incrementalsuse-upgrade-maven-shared-incremental-javadocsuse-upgrade-maven-shared-iosuse-upgrade-maven-shared-io-javadocsuse-upgrade-maven-shared-utilssuse-upgrade-maven-shared-utils-javadocsuse-upgrade-maven-source-pluginsuse-upgrade-maven-source-plugin-javadocsuse-upgrade-maven-surefiresuse-upgrade-maven-surefire-javadocsuse-upgrade-maven-surefire-pluginsuse-upgrade-maven-surefire-plugin-bootstrapsuse-upgrade-maven-surefire-plugins-javadocsuse-upgrade-maven-surefire-provider-junitsuse-upgrade-maven-surefire-provider-junit5suse-upgrade-maven-surefire-provider-junit5-javadocsuse-upgrade-maven-surefire-provider-testngsuse-upgrade-maven-surefire-report-parsersuse-upgrade-maven-surefire-report-pluginsuse-upgrade-maven-surefire-report-plugin-bootstrapsuse-upgrade-maven-test-toolssuse-upgrade-maven-toolchainsuse-upgrade-maven-verifiersuse-upgrade-maven-verifier-javadocsuse-upgrade-maven-wagon-filesuse-upgrade-maven-wagon-ftpsuse-upgrade-maven-wagon-httpsuse-upgrade-maven-wagon-http-lightweightsuse-upgrade-maven-wagon-http-sharedsuse-upgrade-maven-wagon-javadocsuse-upgrade-maven-wagon-provider-apisuse-upgrade-maven-wagon-sshsuse-upgrade-maven-wagon-ssh-commonsuse-upgrade-maven-wagon-ssh-externalsuse-upgrade-maven2-javadocsuse-upgrade-modello-maven-pluginsuse-upgrade-modello-maven-plugin-javadocsuse-upgrade-os-maven-pluginsuse-upgrade-os-maven-plugin-javadocsuse-upgrade-paranamer-maven-pluginsuse-upgrade-spec-version-maven-pluginsuse-upgrade-spec-version-maven-plugin-javadocsuse-upgrade-string-template-maven-pluginsuse-upgrade-string-template-maven-plugin-javadocsuse-upgrade-tesla-polyglot-maven-pluginsuse-upgrade-xml-maven-pluginsuse-upgrade-xml-maven-plugin-javadoc | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | ubuntu-pro-upgrade-libmaven-shared-utils-javaubuntu-upgrade-libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub