In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sisuUpgrade jansiUpgrade maven-wagonUpgrade maven-libUpgrade maven-openjdk17Upgrade maven-wagon-fileUpgrade sisu-plexusUpgrade maven-openjdk8Upgrade apache-commons-codecUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade maven-resolver-connector-basicUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade cdi-apiUpgrade jcl-over-slf4jUpgrade jsr-305Upgrade slf4jUpgrade plexus-sec-dispatcherUpgrade plexus-containers-component-annotationsUpgrade atinjectUpgrade maven-wagon-httpUpgrade aopallianceUpgrade jboss-interceptors-1.2-apiUpgrade maven-wagon-provider-apiUpgrade maven-resolverUpgrade guavaUpgrade maven-resolver-implUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade glassfish-el-apiUpgrade maven-resolver-utilUpgrade mavenUpgrade maven-resolver-transport-wagonUpgrade httpcomponents-coreUpgrade google-guiceUpgrade maven-wagon-http-sharedUpgrade plexus-utilsUpgrade maven-shared-utilsUpgrade guava20Upgrade jsoupUpgrade httpcomponents-clientUpgrade sisu-injectUpgrade geronimo-annotationUpgrade jansi-nativeUpgrade plexus-classworlds | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utilsUpgrade maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade sisu-plexusUpgrade aopallianceUpgrade maven-shared-utilsUpgrade cdi-apiUpgrade jboss-interceptors-1.2-apiUpgrade maven-openjdk17Upgrade maven-wagon-provider-apiUpgrade maven-resolver-utilUpgrade slf4jUpgrade maven-shared-utils-javadocUpgrade maven-wagon-fileUpgrade maven-wagon-http-sharedUpgrade glassfish-el-apiUpgrade maven-resolver-implUpgrade maven-wagonUpgrade guavaUpgrade maven-resolver-transport-wagonUpgrade jansiUpgrade apache-commons-codecUpgrade guava20Upgrade plexus-cipherUpgrade plexus-sec-dispatcherUpgrade plexus-utilsUpgrade sisuUpgrade httpcomponents-clientUpgrade sisu-injectUpgrade hawtjni-runtimeUpgrade maven-resolverUpgrade geronimo-annotationUpgrade plexus-interpolationUpgrade mavenUpgrade maven-resolver-spiUpgrade maven-libUpgrade httpcomponents-coreUpgrade maven-resolver-connector-basicUpgrade apache-commons-ioUpgrade atinjectUpgrade jansi-nativeUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk8Upgrade google-guiceUpgrade jsr-305Upgrade plexus-classworldsUpgrade maven-wagon-httpUpgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade apache-commons-lang3Upgrade maven-resolver-apiUpgrade jcl-over-slf4jUpgrade maven-openjdk11Upgrade jsoup | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade jcl-over-slf4jUpgrade apache-commons-codecUpgrade maven-resolver-connector-basicUpgrade slf4jUpgrade apache-commons-ioUpgrade maven-resolver-transport-wagonUpgrade cdi-apiUpgrade maven-resolver-implUpgrade glassfish-el-apiUpgrade plexus-sec-dispatcherUpgrade httpcomponents-coreUpgrade jansiUpgrade sisu-injectUpgrade maven-openjdk11Upgrade maven-openjdk17Upgrade plexus-cipherUpgrade jboss-interceptors-1.2-apiUpgrade jsr-305Upgrade maven-wagonUpgrade plexus-utilsUpgrade maven-wagon-fileUpgrade maven-wagon-provider-apiUpgrade maven-shared-utils-javadocUpgrade maven-libUpgrade hawtjni-runtimeUpgrade apache-commons-lang3Upgrade sisuUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-http-sharedUpgrade aopallianceUpgrade apache-commons-cliUpgrade google-guiceUpgrade geronimo-annotationUpgrade plexus-classworldsUpgrade sisu-plexusUpgrade atinjectUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade mavenUpgrade maven-resolverUpgrade guava20Upgrade maven-resolver-utilUpgrade maven-openjdk8Upgrade httpcomponents-clientUpgrade guavaUpgrade maven-wagon-httpUpgrade apache-commons-loggingUpgrade jansi-nativeUpgrade maven-shared-utilsUpgrade maven-resolver-apiUpgrade jsoup | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade slf4jUpgrade plexus-utilsUpgrade jansiUpgrade maven-resolver-transport-wagonUpgrade apache-commons-cliUpgrade jboss-interceptors-1.2-apiUpgrade maven-wagon-provider-apiUpgrade maven-resolver-spiUpgrade plexus-containers-component-annotationsUpgrade maven-shared-utilsUpgrade atinjectUpgrade google-guiceUpgrade httpcomponents-clientUpgrade aopallianceUpgrade jansi-nativeUpgrade apache-commons-codecUpgrade guava20Upgrade maven-resolverUpgrade maven-wagon-httpUpgrade httpcomponents-coreUpgrade sisu-injectUpgrade apache-commons-loggingUpgrade maven-resolver-utilUpgrade guavaUpgrade jsr-305Upgrade plexus-classworldsUpgrade maven-openjdk8Upgrade plexus-sec-dispatcherUpgrade plexus-interpolationUpgrade maven-openjdk17Upgrade maven-wagon-http-sharedUpgrade maven-wagonUpgrade maven-resolver-implUpgrade hawtjni-runtimeUpgrade jsoupUpgrade apache-commons-lang3Upgrade mavenUpgrade sisuUpgrade geronimo-annotationUpgrade cdi-apiUpgrade glassfish-el-apiUpgrade maven-shared-utils-javadocUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade apache-commons-ioUpgrade jcl-over-slf4jUpgrade maven-resolver-connector-basicUpgrade sisu-plexusUpgrade maven-wagon-fileUpgrade maven-openjdk11Upgrade maven-lib | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-wagon-http-sharedUpgrade maven-doxia-logging-apiUpgrade maven-plugin-build-helper-javadocUpgrade maven-doxia-sink-apiUpgrade maven-localUpgrade maven-surefire-report-parserUpgrade maven-plugin-tools-apiUpgrade maven-shared-incremental-javadocUpgrade maven-plugin-testing-toolsUpgrade maven-surefire-pluginUpgrade maven-failsafe-pluginUpgrade maven-projectUpgrade xml-maven-pluginUpgrade maven-plugin-bundle-javadocUpgrade maven-doxia-javadocUpgrade maven-resources-pluginUpgrade maven-artifact-transfer-javadocUpgrade maven-enforcer-pluginUpgrade maven-wagon-fileUpgrade javacc-maven-pluginUpgrade maven-plugin-bundleUpgrade maven-shared-utilsUpgrade maven-doxia-module-twikiUpgrade spec-version-maven-pluginUpgrade maven-resolver-transport-httpUpgrade maven-profileUpgrade maven-common-artifact-filtersUpgrade maven-common-artifact-filters-javadocUpgrade maven-shared-ioUpgrade maven-mapping-javadocUpgrade maven-surefireUpgrade maven-plugin-testingUpgrade maven-plugin-tools-antUpgrade maven-file-managementUpgrade maven-remote-resources-pluginUpgrade exec-maven-plugin-javadocUpgrade maven-archiverUpgrade maven-doxia-module-foUpgrade maven-source-pluginUpgrade maven-clean-plugin-javadocUpgrade maven-surefire-plugins-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-dependency-tree-javadocUpgrade maven-plugin-testing-harnessUpgrade maven-clean-pluginUpgrade maven-file-management-javadocUpgrade os-maven-pluginUpgrade maven-resolver-implUpgrade maven-enforcerUpgrade maven-wagon-javadocUpgrade maven-assembly-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-wagon-http-lightweightUpgrade maven-modelUpgrade javacc-maven-plugin-javadocUpgrade maven-javadoc-pluginUpgrade maven-resolver-transport-wagonUpgrade maven-shared-incrementalUpgrade spec-version-maven-plugin-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-doxia-sitetools-javadocUpgrade maven-dependency-pluginUpgrade maven-plugin-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-resolver-utilUpgrade maven-reporting-apiUpgrade maven-plugin-tools-javadocUpgrade maven-install-plugin-javadocUpgrade maven-doxia-coreUpgrade maven-doxia-module-aptUpgrade maven-artifact-managerUpgrade maven-plugin-annotationsUpgrade paranamer-maven-pluginUpgrade maven-doxia-module-rtfUpgrade maven-archiver-javadocUpgrade maven-antrun-plugin-javadocUpgrade maven-resolver-transport-classpathUpgrade string-template-maven-pluginUpgrade maven-reporting-api-javadocUpgrade gmavenplus-pluginUpgrade maven-wagon-ssh-externalUpgrade maven-jar-pluginUpgrade modello-maven-pluginUpgrade maven-assembly-plugin-javadocUpgrade maven-javadoc-plugin-javadocUpgrade maven-surefire-report-pluginUpgrade maven-verifier-javadocUpgrade maven-plugin-tools-modelUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-plugin-registryUpgrade maven-mappingUpgrade maven-dependency-analyzer-javadocUpgrade maven-artifact-resolver-javadocUpgrade hawtjni-maven-pluginUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-doxia-module-fmlUpgrade maven-enforcer-javadocUpgrade maven-doxia-module-confluenceUpgrade maven-toolchainUpgrade maven-plugin-descriptorUpgrade maven-script-antUpgrade maven-resolverUpgrade maven-enforcer-rulesUpgrade maven-filtering-javadocUpgrade maven-doxia-module-latexUpgrade maven-plugin-build-helperUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-resolver-transport-fileUpgrade maven-plugin-tools-javaUpgrade maven-dependency-treeUpgrade maven-surefire-provider-testngUpgrade maven-jar-plugin-javadocUpgrade maven-wagon-httpUpgrade maven-test-toolsUpgrade maven-jar-plugin-bootstrapUpgrade maven-compiler-plugin-bootstrapUpgrade maven-resolver-spiUpgrade maven-surefire-javadocUpgrade maven-shared-io-javadocUpgrade maven-resolver-apiUpgrade bnd-maven-plugin-javadocUpgrade maven-javadocUpgrade maven-invokerUpgrade maven-surefire-provider-junitUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-compiler-plugin-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-doxia-module-docbook-simpleUpgrade bnd-maven-pluginUpgrade maven-wagon-provider-apiUpgrade mavenUpgrade maven-settingsUpgrade maven-surefire-plugin-bootstrapUpgrade maven-plugin-tools-beanshellUpgrade maven-compiler-pluginUpgrade antlr4-maven-pluginUpgrade maven-script-beanshellUpgrade xml-maven-plugin-javadocUpgrade maven-artifact-transferUpgrade maven2-javadocUpgrade exec-maven-pluginUpgrade maven-artifactUpgrade maven-source-plugin-javadocUpgrade maven-resolver-named-locksUpgrade maven-libUpgrade hawtjni-maven-plugin-javadocUpgrade maven-verifierUpgrade maven-invoker-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-antrun-pluginUpgrade maven-artifact-resolverUpgrade maven-resources-plugin-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-resolver-test-utilUpgrade maven-resolver-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-filteringUpgrade maven-dependency-analyzerUpgrade maven-wagon-sshUpgrade maven-shared-utils-javadocUpgrade maven-install-pluginUpgrade maven-plugin-pluginUpgrade string-template-maven-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-wagon-ftpUpgrade maven-resolver-connector-basicUpgrade maven-resources-plugin-bootstrapUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-sitetoolsUpgrade gmavenplus-plugin-javadocUpgrade maven-doxia-module-xdocUpgrade maven-surefire-provider-junit5Upgrade maven-doxia-test-docsUpgrade maven-monitorUpgrade maven-doxia-module-xhtml5Upgrade maven-wagon-ssh-commonUpgrade tesla-polyglot-maven-plugin | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-javaUpgrade libmaven-shared-utils-java (Ubuntu Pro) | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub