In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade guavaUpgrade atinjectUpgrade mavenUpgrade guava20Upgrade sisu-injectUpgrade maven-resolver-transport-wagonUpgrade jsoupUpgrade maven-resolverUpgrade maven-wagon-httpUpgrade jboss-interceptors-1.2-apiUpgrade glassfish-el-apiUpgrade jansi-nativeUpgrade maven-resolver-utilUpgrade plexus-interpolationUpgrade httpcomponents-clientUpgrade maven-resolver-implUpgrade google-guiceUpgrade maven-wagon-http-sharedUpgrade maven-resolver-spiUpgrade plexus-classworldsUpgrade plexus-utilsUpgrade httpcomponents-coreUpgrade aopallianceUpgrade maven-wagon-provider-apiUpgrade geronimo-annotationUpgrade maven-shared-utilsUpgrade apache-commons-ioUpgrade maven-resolver-apiUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade apache-commons-loggingUpgrade sisuUpgrade plexus-cipherUpgrade plexus-sec-dispatcherUpgrade slf4jUpgrade cdi-apiUpgrade maven-wagon-fileUpgrade jansiUpgrade maven-wagonUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk8Upgrade jsr-305Upgrade maven-resolver-connector-basicUpgrade apache-commons-codecUpgrade sisu-plexusUpgrade maven-openjdk11Upgrade jcl-over-slf4jUpgrade apache-commons-cliUpgrade maven-libUpgrade maven-openjdk17 | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utils-javadocUpgrade maven-shared-utils | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade google-guiceUpgrade maven-resolverUpgrade maven-wagon-httpUpgrade jsr-305Upgrade apache-commons-loggingUpgrade geronimo-annotationUpgrade atinjectUpgrade apache-commons-ioUpgrade httpcomponents-coreUpgrade maven-resolver-connector-basicUpgrade plexus-classworldsUpgrade hawtjni-runtimeUpgrade plexus-containers-component-annotationsUpgrade jansi-nativeUpgrade maven-openjdk8Upgrade apache-commons-lang3Upgrade mavenUpgrade maven-resolver-apiUpgrade maven-libUpgrade jcl-over-slf4jUpgrade jsoupUpgrade maven-openjdk11Upgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade sisu-injectUpgrade apache-commons-cliUpgrade maven-wagon-http-sharedUpgrade maven-wagonUpgrade maven-resolver-transport-wagonUpgrade maven-shared-utils-javadocUpgrade sisu-plexusUpgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade guava20Upgrade maven-openjdk17Upgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade plexus-sec-dispatcherUpgrade plexus-utilsUpgrade sisuUpgrade guavaUpgrade apache-commons-codecUpgrade slf4jUpgrade maven-resolver-implUpgrade maven-resolver-utilUpgrade plexus-cipherUpgrade jansiUpgrade httpcomponents-clientUpgrade maven-wagon-provider-apiUpgrade aopallianceUpgrade cdi-api | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade maven-openjdk8Upgrade maven-wagon-httpUpgrade httpcomponents-clientUpgrade plexus-classworldsUpgrade guavaUpgrade maven-resolver-utilUpgrade mavenUpgrade maven-shared-utilsUpgrade jsoupUpgrade geronimo-annotationUpgrade sisu-plexusUpgrade aopallianceUpgrade atinjectUpgrade google-guiceUpgrade maven-resolver-apiUpgrade maven-wagon-http-sharedUpgrade guava20Upgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade jansi-nativeUpgrade maven-resolverUpgrade jansiUpgrade maven-wagon-provider-apiUpgrade slf4jUpgrade sisuUpgrade maven-wagonUpgrade jsr-305Upgrade plexus-cipherUpgrade maven-shared-utils-javadocUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade apache-commons-codecUpgrade maven-openjdk11Upgrade maven-openjdk17Upgrade jboss-interceptors-1.2-apiUpgrade maven-resolver-implUpgrade httpcomponents-coreUpgrade maven-resolver-connector-basicUpgrade jcl-over-slf4jUpgrade cdi-apiUpgrade apache-commons-ioUpgrade sisu-injectUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-fileUpgrade maven-resolver-transport-wagonUpgrade glassfish-el-apiUpgrade plexus-sec-dispatcherUpgrade plexus-utilsUpgrade maven-lib | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade plexus-utilsUpgrade apache-commons-cliUpgrade jansiUpgrade httpcomponents-coreUpgrade maven-resolver-spiUpgrade atinjectUpgrade jboss-interceptors-1.2-apiUpgrade slf4jUpgrade aopallianceUpgrade apache-commons-loggingUpgrade jansi-nativeUpgrade maven-resolver-transport-wagonUpgrade sisu-injectUpgrade apache-commons-codecUpgrade maven-shared-utilsUpgrade maven-wagon-provider-apiUpgrade httpcomponents-clientUpgrade guava20Upgrade google-guiceUpgrade plexus-containers-component-annotationsUpgrade maven-resolverUpgrade maven-wagon-httpUpgrade sisu-plexusUpgrade maven-wagon-fileUpgrade jsoupUpgrade maven-resolver-connector-basicUpgrade mavenUpgrade geronimo-annotationUpgrade maven-resolver-apiUpgrade glassfish-el-apiUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade cdi-apiUpgrade maven-shared-utils-javadocUpgrade maven-resolver-utilUpgrade sisuUpgrade guavaUpgrade maven-resolver-implUpgrade plexus-classworldsUpgrade maven-libUpgrade plexus-sec-dispatcherUpgrade plexus-interpolationUpgrade maven-openjdk17Upgrade maven-wagon-http-sharedUpgrade apache-commons-lang3Upgrade jsr-305Upgrade hawtjni-runtimeUpgrade maven-wagonUpgrade plexus-cipherUpgrade maven-openjdk8Upgrade jcl-over-slf4j | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-doxia-sitetoolsUpgrade maven-resolver-connector-basicUpgrade maven-resources-plugin-bootstrapUpgrade maven-wagon-ftpUpgrade string-template-maven-plugin-javadocUpgrade hawtjni-maven-plugin-javadocUpgrade maven2-javadocUpgrade maven-resolverUpgrade maven-surefire-provider-junit5Upgrade gmavenplus-plugin-javadocUpgrade maven-artifactUpgrade maven-plugin-descriptorUpgrade maven-enforcer-javadocUpgrade maven-libUpgrade maven-script-antUpgrade maven-source-plugin-javadocUpgrade maven-install-pluginUpgrade maven-resolver-test-utilUpgrade maven-shared-utils-javadocUpgrade maven-plugin-tools-beanshellUpgrade maven-artifact-transferUpgrade maven-monitorUpgrade maven-script-beanshellUpgrade maven-surefire-report-pluginUpgrade maven-settingsUpgrade maven-doxia-module-xhtmlUpgrade maven-invoker-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-verifierUpgrade modello-maven-plugin-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-wagon-sshUpgrade mavenUpgrade maven-toolchainUpgrade maven-antrun-pluginUpgrade maven-filteringUpgrade hawtjni-maven-pluginUpgrade maven-artifact-resolver-javadocUpgrade tesla-polyglot-maven-pluginUpgrade maven-dependency-analyzer-javadocUpgrade maven-plugin-pluginUpgrade maven-doxia-module-confluenceUpgrade maven-filtering-javadocUpgrade bnd-maven-plugin-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-resolver-named-locksUpgrade maven-artifact-resolverUpgrade exec-maven-pluginUpgrade xml-maven-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-enforcer-rulesUpgrade maven-compiler-plugin-bootstrapUpgrade maven-doxia-test-docsUpgrade maven-plugin-registryUpgrade maven-invokerUpgrade maven-mappingUpgrade maven-plugin-tools-modelUpgrade maven-resolver-apiUpgrade maven-surefire-javadocUpgrade maven-resources-plugin-javadocUpgrade bnd-maven-pluginUpgrade maven-doxia-module-fmlUpgrade maven-javadocUpgrade maven-doxia-module-latexUpgrade maven-surefire-provider-junitUpgrade maven-dependency-analyzerUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-wagon-ssh-commonUpgrade maven-surefire-plugin-bootstrapUpgrade antlr4-maven-pluginUpgrade maven-doxia-module-docbook-simpleUpgrade maven-compiler-plugin-javadocUpgrade maven-compiler-pluginUpgrade maven-wagon-provider-apiUpgrade maven-resolver-javadocUpgrade maven-verifier-javadocUpgrade maven-doxia-module-xdocUpgrade maven-remote-resources-plugin-javadocUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-plugin-tools-javaUpgrade maven-resolver-transport-fileUpgrade maven-dependency-treeUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-plugin-build-helperUpgrade maven-surefire-provider-testngUpgrade maven-jar-plugin-javadocUpgrade maven-wagon-httpUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-shared-io-javadocUpgrade maven-resolver-spiUpgrade maven-jar-plugin-bootstrapUpgrade maven-test-toolsUpgrade maven-doxia-sitetools-javadocUpgrade maven-clean-pluginUpgrade maven-reporting-api-javadocUpgrade maven-enforcer-apiUpgrade maven-javadoc-pluginUpgrade maven-doxia-module-twikiUpgrade maven-common-artifact-filters-javadocUpgrade maven-artifact-transfer-javadocUpgrade maven-doxia-module-rtfUpgrade maven-shared-incremental-javadocUpgrade maven-file-management-javadocUpgrade maven-modelUpgrade maven-plugin-tools-apiUpgrade maven-doxia-logging-apiUpgrade maven-reporting-apiUpgrade maven-artifact-managerUpgrade maven-resolver-utilUpgrade maven-jar-pluginUpgrade maven-plugin-testing-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-doxia-coreUpgrade maven-doxia-module-aptUpgrade maven-doxia-sink-apiUpgrade os-maven-pluginUpgrade maven-wagon-fileUpgrade maven-mapping-javadocUpgrade maven-plugin-tools-javadocUpgrade spec-version-maven-pluginUpgrade maven-dependency-pluginUpgrade maven-plugin-annotationsUpgrade maven-wagon-ssh-externalUpgrade maven-clean-plugin-javadocUpgrade paranamer-maven-pluginUpgrade maven-resolver-implUpgrade maven-shared-ioUpgrade maven-common-artifact-filtersUpgrade maven-javadoc-plugin-javadocUpgrade javacc-maven-pluginUpgrade maven-localUpgrade maven-doxia-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-wagon-http-lightweightUpgrade maven-plugin-build-helper-javadocUpgrade maven-wagon-http-sharedUpgrade maven-plugin-bundle-javadocUpgrade maven-assembly-plugin-javadocUpgrade javacc-maven-plugin-javadocUpgrade maven-plugin-testing-harnessUpgrade maven-assembly-pluginUpgrade maven-enforcerUpgrade string-template-maven-pluginUpgrade modello-maven-pluginUpgrade maven-dependency-plugin-javadocUpgrade maven-surefire-plugins-javadocUpgrade maven-resolver-transport-httpUpgrade maven-resolver-transport-classpathUpgrade xml-maven-pluginUpgrade maven-shared-utilsUpgrade maven-surefire-pluginUpgrade maven-wagon-javadocUpgrade maven-surefireUpgrade maven-install-plugin-javadocUpgrade maven-resources-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-dependency-tree-javadocUpgrade maven-antrun-plugin-javadocUpgrade gmavenplus-pluginUpgrade maven-projectUpgrade maven-failsafe-pluginUpgrade spec-version-maven-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade maven-plugin-testingUpgrade maven-plugin-tools-antUpgrade maven-file-managementUpgrade maven-doxia-module-foUpgrade maven-archiverUpgrade exec-maven-plugin-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-source-pluginUpgrade maven-shared-incrementalUpgrade maven-surefire-report-parserUpgrade maven-enforcer-pluginUpgrade maven-profileUpgrade maven-plugin-bundleUpgrade maven-archiver-javadoc | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub