In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-wagon-http-sharedUpgrade maven-wagon-provider-apiUpgrade jsoupUpgrade maven-resolver-transport-wagonUpgrade plexus-utilsUpgrade plexus-interpolationUpgrade maven-resolver-implUpgrade atinjectUpgrade maven-resolverUpgrade aopallianceUpgrade jansi-nativeUpgrade httpcomponents-clientUpgrade google-guiceUpgrade maven-resolver-spiUpgrade glassfish-el-apiUpgrade maven-resolver-utilUpgrade geronimo-annotationUpgrade maven-shared-utilsUpgrade guava20Upgrade sisu-injectUpgrade mavenUpgrade maven-wagon-httpUpgrade httpcomponents-coreUpgrade jboss-interceptors-1.2-apiUpgrade guavaUpgrade plexus-classworldsUpgrade hawtjni-runtimeUpgrade maven-libUpgrade apache-commons-ioUpgrade maven-wagon-fileUpgrade apache-commons-lang3Upgrade maven-resolver-connector-basicUpgrade apache-commons-cliUpgrade maven-wagonUpgrade jansiUpgrade cdi-apiUpgrade apache-commons-loggingUpgrade slf4jUpgrade plexus-sec-dispatcherUpgrade jsr-305Upgrade maven-openjdk8Upgrade maven-openjdk11Upgrade plexus-containers-component-annotationsUpgrade maven-resolver-apiUpgrade sisuUpgrade apache-commons-codecUpgrade jcl-over-slf4jUpgrade plexus-cipherUpgrade maven-openjdk17Upgrade sisu-plexus | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utilsUpgrade maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade maven-resolver-apiUpgrade apache-commons-lang3Upgrade atinjectUpgrade jcl-over-slf4jUpgrade sisu-injectUpgrade maven-resolver-connector-basicUpgrade maven-resolver-spiUpgrade mavenUpgrade plexus-interpolationUpgrade maven-openjdk11Upgrade apache-commons-cliUpgrade httpcomponents-coreUpgrade apache-commons-ioUpgrade apache-commons-loggingUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk8Upgrade plexus-classworldsUpgrade maven-wagon-httpUpgrade jansi-nativeUpgrade jsoupUpgrade jsr-305Upgrade geronimo-annotationUpgrade google-guiceUpgrade maven-resolverUpgrade maven-libUpgrade hawtjni-runtimeUpgrade guavaUpgrade apache-commons-codecUpgrade plexus-cipherUpgrade jansiUpgrade maven-shared-utilsUpgrade jboss-interceptors-1.2-apiUpgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade aopallianceUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade httpcomponents-clientUpgrade sisuUpgrade plexus-utilsUpgrade plexus-sec-dispatcherUpgrade maven-resolver-utilUpgrade maven-resolver-implUpgrade slf4jUpgrade maven-resolver-transport-wagonUpgrade maven-openjdk17Upgrade sisu-plexusUpgrade maven-wagonUpgrade maven-shared-utils-javadocUpgrade cdi-apiUpgrade guava20 | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade maven-openjdk8Upgrade apache-commons-cliUpgrade google-guiceUpgrade geronimo-annotationUpgrade plexus-classworldsUpgrade maven-resolver-spiUpgrade guava20Upgrade plexus-interpolationUpgrade maven-resolver-utilUpgrade maven-shared-utilsUpgrade maven-resolver-apiUpgrade jsoupUpgrade maven-wagon-http-sharedUpgrade jansi-nativeUpgrade maven-resolverUpgrade mavenUpgrade sisu-plexusUpgrade atinjectUpgrade aopallianceUpgrade httpcomponents-clientUpgrade maven-wagon-httpUpgrade apache-commons-loggingUpgrade guavaUpgrade maven-openjdk17Upgrade maven-libUpgrade maven-wagonUpgrade jboss-interceptors-1.2-apiUpgrade maven-openjdk11Upgrade plexus-cipherUpgrade sisuUpgrade apache-commons-codecUpgrade jsr-305Upgrade maven-resolver-connector-basicUpgrade maven-shared-utils-javadocUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade jcl-over-slf4jUpgrade maven-wagon-fileUpgrade apache-commons-ioUpgrade plexus-containers-component-annotationsUpgrade cdi-apiUpgrade glassfish-el-apiUpgrade maven-resolver-transport-wagonUpgrade sisu-injectUpgrade jansiUpgrade maven-resolver-implUpgrade slf4jUpgrade httpcomponents-coreUpgrade plexus-utilsUpgrade maven-wagon-provider-apiUpgrade plexus-sec-dispatcher | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 23, 2022 |
| Redhat_linux | — | Upgrade hawtjni-runtimeUpgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade sisuUpgrade maven-resolver-utilUpgrade maven-openjdk8Upgrade guavaUpgrade maven-wagonUpgrade plexus-sec-dispatcherUpgrade glassfish-el-apiUpgrade maven-resolver-implUpgrade mavenUpgrade maven-openjdk17Upgrade jsr-305Upgrade maven-wagon-http-sharedUpgrade maven-libUpgrade maven-shared-utils-javadocUpgrade plexus-classworldsUpgrade plexus-interpolationUpgrade cdi-apiUpgrade maven-wagon-fileUpgrade sisu-plexusUpgrade jcl-over-slf4jUpgrade jsoupUpgrade maven-resolver-connector-basicUpgrade geronimo-annotationUpgrade maven-openjdk11Upgrade jansiUpgrade maven-wagon-provider-apiUpgrade jboss-interceptors-1.2-apiUpgrade httpcomponents-coreUpgrade apache-commons-codecUpgrade maven-resolver-spiUpgrade maven-resolverUpgrade plexus-containers-component-annotationsUpgrade guava20Upgrade slf4jUpgrade maven-wagon-httpUpgrade aopallianceUpgrade maven-shared-utilsUpgrade google-guiceUpgrade jansi-nativeUpgrade apache-commons-loggingUpgrade atinjectUpgrade httpcomponents-clientUpgrade apache-commons-cliUpgrade maven-resolver-transport-wagonUpgrade sisu-injectUpgrade plexus-utils | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-surefire-report-pluginUpgrade maven-resolver-test-utilUpgrade maven-libUpgrade maven-plugin-descriptorUpgrade maven-shared-utils-javadocUpgrade maven-dependency-analyzerUpgrade maven-antrun-pluginUpgrade maven-filteringUpgrade maven-doxia-module-latexUpgrade bnd-maven-pluginUpgrade maven-wagon-provider-apiUpgrade maven-wagon-sshUpgrade maven-install-pluginUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-filtering-javadocUpgrade maven-plugin-pluginUpgrade maven-settingsUpgrade maven-enforcer-rulesUpgrade maven-doxia-module-confluenceUpgrade maven-resolver-named-locksUpgrade mavenUpgrade maven-compiler-pluginUpgrade antlr4-maven-pluginUpgrade maven-plugin-tools-beanshellUpgrade maven-doxia-module-xhtmlUpgrade maven-resources-plugin-javadocUpgrade xml-maven-plugin-javadocUpgrade maven-script-beanshellUpgrade maven-doxia-test-docsUpgrade maven-resolver-javadocUpgrade maven-monitorUpgrade maven-plugin-tools-generatorsUpgrade maven-verifierUpgrade maven-doxia-module-xhtml5Upgrade maven-surefire-plugin-bootstrapUpgrade os-maven-plugin-javadocUpgrade exec-maven-pluginUpgrade hawtjni-maven-plugin-javadocUpgrade maven-artifact-resolverUpgrade maven-invoker-javadocUpgrade maven-resolver-transport-fileUpgrade maven-surefire-provider-testngUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-doxia-module-docbook-simpleUpgrade maven-jar-plugin-bootstrapUpgrade maven-plugin-build-helperUpgrade maven-wagon-httpUpgrade maven-jar-plugin-javadocUpgrade maven-dependency-treeUpgrade maven-test-toolsUpgrade maven-plugin-tools-javaUpgrade maven-artifact-transferUpgrade maven-verifier-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-toolchainUpgrade maven-resolverUpgrade maven-source-plugin-javadocUpgrade maven-artifactUpgrade maven-enforcer-javadocUpgrade maven-surefire-provider-junit5Upgrade maven2-javadocUpgrade maven-script-antUpgrade maven-resources-plugin-bootstrapUpgrade maven-wagon-ftpUpgrade maven-doxia-sitetoolsUpgrade maven-plugin-tools-annotationsUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-invokerUpgrade maven-shared-io-javadocUpgrade maven-surefire-provider-junitUpgrade maven-plugin-tools-modelUpgrade bnd-maven-plugin-javadocUpgrade tesla-polyglot-maven-pluginUpgrade maven-wagon-ssh-commonUpgrade maven-plugin-registryUpgrade maven-compiler-plugin-bootstrapUpgrade maven-dependency-analyzer-javadocUpgrade maven-artifact-resolver-javadocUpgrade maven-mappingUpgrade hawtjni-maven-pluginUpgrade maven-doxia-module-fmlUpgrade maven-javadocUpgrade maven-compiler-plugin-javadocUpgrade maven-resolver-connector-basicUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-module-xdocUpgrade maven-surefire-provider-junit5-javadocUpgrade string-template-maven-plugin-javadocUpgrade gmavenplus-plugin-javadocUpgrade maven-resolver-apiUpgrade maven-resolver-spiUpgrade maven-surefire-javadocUpgrade maven-file-management-javadocUpgrade maven-failsafe-pluginUpgrade maven-assembly-pluginUpgrade maven-antrun-plugin-javadocUpgrade gmavenplus-pluginUpgrade maven-surefireUpgrade maven-plugin-tools-javadocUpgrade maven-dependency-pluginUpgrade maven-wagon-fileUpgrade maven-resolver-transport-httpUpgrade maven-modelUpgrade javacc-maven-pluginUpgrade maven-surefire-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-wagon-http-lightweightUpgrade maven-doxia-module-foUpgrade xml-maven-pluginUpgrade maven-doxia-sink-apiUpgrade maven-doxia-logging-apiUpgrade maven-doxia-javadocUpgrade maven-wagon-http-sharedUpgrade maven-plugin-testing-toolsUpgrade maven-plugin-bundle-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-plugin-testingUpgrade maven-surefire-report-parserUpgrade maven-shared-incremental-javadocUpgrade maven-plugin-tools-antUpgrade maven-doxia-module-rtfUpgrade maven-artifact-transfer-javadocUpgrade maven-doxia-module-twikiUpgrade maven-profileUpgrade paranamer-maven-pluginUpgrade maven-javadoc-plugin-javadocUpgrade maven-wagon-ssh-externalUpgrade maven-resolver-transport-classpathUpgrade maven-plugin-annotationsUpgrade maven-clean-plugin-javadocUpgrade maven-projectUpgrade maven-plugin-bundleUpgrade maven-archiver-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-file-managementUpgrade maven-archiverUpgrade spec-version-maven-plugin-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-localUpgrade maven-dependency-plugin-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-clean-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-resolver-utilUpgrade maven-plugin-testing-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-jar-pluginUpgrade maven-doxia-module-aptUpgrade maven-doxia-coreUpgrade maven-artifact-managerUpgrade maven-enforcerUpgrade maven-reporting-apiUpgrade string-template-maven-pluginUpgrade maven-surefire-plugins-javadocUpgrade maven-reporting-api-javadocUpgrade javacc-maven-plugin-javadocUpgrade modello-maven-pluginUpgrade maven-enforcer-apiUpgrade maven-javadoc-pluginUpgrade maven-doxia-sitetools-javadocUpgrade os-maven-pluginUpgrade maven-source-pluginUpgrade maven-shared-incrementalUpgrade exec-maven-plugin-javadocUpgrade maven-remote-resources-pluginUpgrade maven-shared-ioUpgrade maven-plugin-tools-apiUpgrade maven-mapping-javadocUpgrade spec-version-maven-pluginUpgrade maven-wagon-javadocUpgrade maven-shared-utilsUpgrade maven-resources-pluginUpgrade maven-resolver-implUpgrade maven-install-plugin-javadocUpgrade maven-enforcer-pluginUpgrade maven-dependency-tree-javadocUpgrade maven-common-artifact-filters | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub