In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cdi-apiUpgrade maven-openjdk11Upgrade maven-resolver-connector-basicUpgrade sisu-plexusUpgrade jansiUpgrade maven-wagonUpgrade apache-commons-cliUpgrade maven-openjdk17Upgrade apache-commons-loggingUpgrade jsr-305Upgrade plexus-containers-component-annotationsUpgrade apache-commons-ioUpgrade plexus-sec-dispatcherUpgrade maven-wagon-fileUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade maven-openjdk8Upgrade jcl-over-slf4jUpgrade slf4jUpgrade apache-commons-lang3Upgrade apache-commons-codecUpgrade hawtjni-runtimeUpgrade sisuUpgrade maven-libUpgrade maven-resolver-utilUpgrade atinjectUpgrade guava20Upgrade jboss-interceptors-1.2-apiUpgrade maven-wagon-provider-apiUpgrade maven-resolver-transport-wagonUpgrade maven-shared-utilsUpgrade mavenUpgrade guavaUpgrade maven-wagon-httpUpgrade glassfish-el-apiUpgrade plexus-interpolationUpgrade jansi-nativeUpgrade maven-wagon-http-sharedUpgrade plexus-classworldsUpgrade maven-resolver-implUpgrade maven-resolverUpgrade jsoupUpgrade maven-resolver-spiUpgrade plexus-utilsUpgrade httpcomponents-coreUpgrade google-guiceUpgrade sisu-injectUpgrade aopallianceUpgrade geronimo-annotationUpgrade httpcomponents-client | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utilsUpgrade maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade httpcomponents-clientUpgrade jansiUpgrade plexus-cipherUpgrade sisuUpgrade plexus-sec-dispatcherUpgrade maven-resolver-utilUpgrade plexus-utilsUpgrade maven-resolver-implUpgrade maven-openjdk17Upgrade maven-resolver-transport-wagonUpgrade maven-wagonUpgrade cdi-apiUpgrade slf4jUpgrade guavaUpgrade sisu-plexusUpgrade guava20Upgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade maven-shared-utils-javadocUpgrade aopallianceUpgrade apache-commons-codecUpgrade glassfish-el-apiUpgrade maven-wagon-fileUpgrade maven-wagon-http-sharedUpgrade maven-wagon-provider-apiUpgrade maven-resolverUpgrade jsoupUpgrade jcl-over-slf4jUpgrade apache-commons-loggingUpgrade apache-commons-lang3Upgrade maven-resolver-connector-basicUpgrade maven-openjdk8Upgrade jansi-nativeUpgrade plexus-containers-component-annotationsUpgrade sisu-injectUpgrade maven-resolver-apiUpgrade apache-commons-ioUpgrade apache-commons-cliUpgrade maven-openjdk11Upgrade atinjectUpgrade maven-libUpgrade plexus-classworldsUpgrade maven-wagon-httpUpgrade jsr-305Upgrade google-guiceUpgrade mavenUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade geronimo-annotationUpgrade hawtjni-runtimeUpgrade httpcomponents-core | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade maven-resolver-implUpgrade maven-wagon-provider-apiUpgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade maven-resolver-transport-wagonUpgrade plexus-containers-component-annotationsUpgrade plexus-utilsUpgrade jansiUpgrade maven-openjdk11Upgrade apache-commons-ioUpgrade httpcomponents-coreUpgrade cdi-apiUpgrade sisu-injectUpgrade hawtjni-runtimeUpgrade maven-openjdk17Upgrade jboss-interceptors-1.2-apiUpgrade plexus-sec-dispatcherUpgrade apache-commons-lang3Upgrade maven-shared-utils-javadocUpgrade maven-libUpgrade apache-commons-codecUpgrade sisuUpgrade jsr-305Upgrade slf4jUpgrade maven-wagonUpgrade plexus-cipherUpgrade jcl-over-slf4jUpgrade maven-resolver-connector-basicUpgrade httpcomponents-clientUpgrade maven-openjdk8Upgrade apache-commons-loggingUpgrade maven-wagon-httpUpgrade apache-commons-cliUpgrade sisu-plexusUpgrade jansi-nativeUpgrade aopallianceUpgrade maven-resolver-utilUpgrade guavaUpgrade guava20Upgrade jsoupUpgrade maven-resolver-apiUpgrade maven-wagon-http-sharedUpgrade maven-resolverUpgrade maven-shared-utilsUpgrade mavenUpgrade plexus-classworldsUpgrade atinjectUpgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade google-guiceUpgrade geronimo-annotation | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade mavenUpgrade jcl-over-slf4jUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade maven-wagonUpgrade plexus-classworldsUpgrade maven-wagon-fileUpgrade plexus-sec-dispatcherUpgrade plexus-interpolationUpgrade sisu-plexusUpgrade maven-openjdk11Upgrade sisuUpgrade maven-resolver-implUpgrade hawtjni-runtimeUpgrade maven-libUpgrade jsr-305Upgrade maven-openjdk17Upgrade maven-shared-utils-javadocUpgrade maven-resolver-utilUpgrade maven-wagon-http-sharedUpgrade apache-commons-ioUpgrade jsoupUpgrade geronimo-annotationUpgrade cdi-apiUpgrade guavaUpgrade glassfish-el-apiUpgrade maven-resolver-connector-basicUpgrade plexus-cipherUpgrade maven-resolver-apiUpgrade aopallianceUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade maven-resolver-transport-wagonUpgrade guava20Upgrade slf4jUpgrade apache-commons-codecUpgrade plexus-utilsUpgrade apache-commons-loggingUpgrade jansi-nativeUpgrade maven-shared-utilsUpgrade sisu-injectUpgrade google-guiceUpgrade httpcomponents-clientUpgrade maven-wagon-provider-apiUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-httpUpgrade httpcomponents-coreUpgrade apache-commons-cliUpgrade atinjectUpgrade jboss-interceptors-1.2-apiUpgrade jansi | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-resolver-transport-fileUpgrade maven-dependency-treeUpgrade maven-plugin-tools-generatorsUpgrade maven-resolver-named-locksUpgrade maven-surefire-plugin-bootstrapUpgrade tesla-polyglot-maven-pluginUpgrade maven-mappingUpgrade maven-doxia-module-latexUpgrade maven2-javadocUpgrade maven-artifactUpgrade exec-maven-pluginUpgrade maven-toolchainUpgrade maven-antrun-pluginUpgrade gmavenplus-plugin-javadocUpgrade xml-maven-plugin-javadocUpgrade maven-doxia-module-fmlUpgrade maven-resources-plugin-javadocUpgrade maven-install-pluginUpgrade maven-artifact-transferUpgrade maven-plugin-pluginUpgrade maven-surefire-report-plugin-bootstrapUpgrade os-maven-plugin-javadocUpgrade maven-dependency-analyzer-javadocUpgrade maven-doxia-module-confluenceUpgrade maven-invoker-javadocUpgrade maven-dependency-analyzerUpgrade maven-shared-utils-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-filteringUpgrade maven-doxia-test-docsUpgrade maven-surefire-provider-testngUpgrade bnd-maven-pluginUpgrade maven-test-toolsUpgrade maven-resolver-test-utilUpgrade maven-jar-plugin-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-plugin-build-helperUpgrade maven-plugin-tools-javaUpgrade maven-wagon-httpUpgrade maven-wagon-sshUpgrade maven-monitorUpgrade maven-artifact-resolverUpgrade maven-doxia-module-xhtml5Upgrade maven-surefire-report-pluginUpgrade maven-verifierUpgrade maven-jar-plugin-bootstrapUpgrade maven-doxia-module-docbook-simpleUpgrade maven-enforcer-rulesUpgrade maven-libUpgrade mavenUpgrade maven-source-plugin-javadocUpgrade maven-wagon-provider-apiUpgrade hawtjni-maven-plugin-javadocUpgrade maven-enforcer-javadocUpgrade maven-plugin-descriptorUpgrade maven-script-antUpgrade maven-resolver-javadocUpgrade maven-resolverUpgrade maven-doxia-sitetoolsUpgrade maven-invokerUpgrade maven-javadocUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-resolver-apiUpgrade bnd-maven-plugin-javadocUpgrade maven-compiler-plugin-bootstrapUpgrade maven-compiler-plugin-javadocUpgrade maven-surefire-javadocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-resolver-spiUpgrade antlr4-maven-pluginUpgrade maven-plugin-tools-annotationsUpgrade maven-surefire-provider-junitUpgrade maven-shared-io-javadocUpgrade string-template-maven-plugin-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-settingsUpgrade maven-doxia-module-xdocUpgrade maven-plugin-tools-beanshellUpgrade maven-script-beanshellUpgrade maven-verifier-javadocUpgrade maven-remote-resources-plugin-javadocUpgrade maven-plugin-tools-modelUpgrade hawtjni-maven-pluginUpgrade maven-wagon-ssh-commonUpgrade maven-artifact-resolver-javadocUpgrade maven-plugin-registryUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-compiler-pluginUpgrade maven-resolver-connector-basicUpgrade maven-resources-plugin-bootstrapUpgrade maven-filtering-javadocUpgrade maven-wagon-ftpUpgrade javacc-maven-plugin-javadocUpgrade maven-enforcerUpgrade maven-failsafe-pluginUpgrade maven-clean-plugin-javadocUpgrade maven-doxia-module-aptUpgrade maven-clean-pluginUpgrade maven-assembly-pluginUpgrade maven-reporting-api-javadocUpgrade string-template-maven-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-surefire-plugins-javadocUpgrade maven-javadoc-pluginUpgrade javacc-maven-pluginUpgrade modello-maven-pluginUpgrade maven-surefire-report-parserUpgrade maven-plugin-bundleUpgrade maven-projectUpgrade maven-profileUpgrade maven-archiver-javadocUpgrade maven-doxia-module-twikiUpgrade maven-doxia-module-rtfUpgrade maven-artifact-transfer-javadocUpgrade maven-jar-pluginUpgrade maven-doxia-sitetools-javadocUpgrade maven-shared-utilsUpgrade maven-wagon-javadocUpgrade maven-surefireUpgrade maven-resources-pluginUpgrade maven-resolver-implUpgrade maven-install-plugin-javadocUpgrade maven-common-artifact-filtersUpgrade maven-dependency-tree-javadocUpgrade gmavenplus-pluginUpgrade maven-enforcer-pluginUpgrade maven-antrun-plugin-javadocUpgrade maven-surefire-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-plugin-testing-toolsUpgrade maven-wagon-http-sharedUpgrade maven-plugin-bundle-javadocUpgrade maven-wagon-http-lightweightUpgrade maven-plugin-build-helper-javadocUpgrade maven-localUpgrade maven-doxia-logging-apiUpgrade maven-doxia-sink-apiUpgrade xml-maven-pluginUpgrade maven-doxia-javadocUpgrade maven-artifact-managerUpgrade paranamer-maven-pluginUpgrade maven-wagon-ssh-externalUpgrade maven-resolver-transport-classpathUpgrade maven-doxia-coreUpgrade maven-plugin-annotationsUpgrade maven-plugin-testing-javadocUpgrade maven-reporting-apiUpgrade maven-javadoc-plugin-javadocUpgrade maven-resolver-utilUpgrade maven-shared-incremental-javadocUpgrade maven-plugin-tools-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-resolver-transport-wagonUpgrade os-maven-pluginUpgrade maven-shared-ioUpgrade maven-mapping-javadocUpgrade maven-plugin-tools-apiUpgrade maven-modelUpgrade maven-dependency-pluginUpgrade maven-wagon-fileUpgrade maven-plugin-tools-antUpgrade maven-plugin-testingUpgrade maven-shared-incrementalUpgrade maven-source-pluginUpgrade exec-maven-plugin-javadocUpgrade maven-archiverUpgrade maven-file-management-javadocUpgrade maven-remote-resources-pluginUpgrade maven-doxia-module-foUpgrade spec-version-maven-plugin-javadocUpgrade spec-version-maven-pluginUpgrade maven-file-managementUpgrade maven-resolver-transport-httpUpgrade maven-enforcer-apiUpgrade maven-dependency-plugin-javadocUpgrade maven-assembly-plugin-javadoc | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-javaUpgrade libmaven-shared-utils-java (Ubuntu Pro) | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub