In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade plexus-containers-component-annotationsUpgrade jansiUpgrade cdi-apiUpgrade maven-wagonUpgrade apache-commons-ioUpgrade jsr-305Upgrade slf4jUpgrade plexus-sec-dispatcherUpgrade maven-openjdk8Upgrade sisuUpgrade maven-libUpgrade apache-commons-codecUpgrade maven-resolver-connector-basicUpgrade maven-openjdk17Upgrade maven-openjdk11Upgrade sisu-plexusUpgrade apache-commons-loggingUpgrade plexus-cipherUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade jcl-over-slf4jUpgrade apache-commons-cliUpgrade maven-wagon-fileUpgrade maven-resolver-apiUpgrade glassfish-el-apiUpgrade jansi-nativeUpgrade sisu-injectUpgrade plexus-interpolationUpgrade httpcomponents-coreUpgrade guava20Upgrade maven-resolver-implUpgrade jboss-interceptors-1.2-apiUpgrade geronimo-annotationUpgrade maven-resolverUpgrade maven-shared-utilsUpgrade jsoupUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade guavaUpgrade maven-resolver-transport-wagonUpgrade plexus-classworldsUpgrade httpcomponents-clientUpgrade maven-resolver-utilUpgrade google-guiceUpgrade maven-resolver-spiUpgrade aopallianceUpgrade plexus-utilsUpgrade maven-wagon-httpUpgrade atinjectUpgrade maven | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utils-javadocUpgrade maven-shared-utils | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade apache-commons-codecUpgrade maven-resolver-utilUpgrade slf4jUpgrade guavaUpgrade maven-shared-utils-javadocUpgrade maven-wagonUpgrade sisu-plexusUpgrade maven-resolver-implUpgrade plexus-utilsUpgrade plexus-sec-dispatcherUpgrade httpcomponents-clientUpgrade jansiUpgrade maven-resolver-transport-wagonUpgrade jboss-interceptors-1.2-apiUpgrade plexus-cipherUpgrade maven-shared-utilsUpgrade maven-wagon-http-sharedUpgrade maven-wagon-provider-apiUpgrade guava20Upgrade cdi-apiUpgrade maven-openjdk17Upgrade sisuUpgrade aopallianceUpgrade glassfish-el-apiUpgrade maven-wagon-fileUpgrade atinjectUpgrade jsr-305Upgrade maven-resolver-connector-basicUpgrade httpcomponents-coreUpgrade plexus-classworldsUpgrade maven-libUpgrade maven-resolver-spiUpgrade mavenUpgrade maven-wagon-httpUpgrade apache-commons-ioUpgrade jansi-nativeUpgrade plexus-containers-component-annotationsUpgrade maven-openjdk8Upgrade google-guiceUpgrade geronimo-annotationUpgrade hawtjni-runtimeUpgrade apache-commons-lang3Upgrade maven-resolver-apiUpgrade maven-resolverUpgrade maven-openjdk11Upgrade jcl-over-slf4jUpgrade apache-commons-loggingUpgrade sisu-injectUpgrade jsoupUpgrade apache-commons-cliUpgrade plexus-interpolation | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade sisu-injectUpgrade apache-commons-ioUpgrade cdi-apiUpgrade glassfish-el-apiUpgrade plexus-containers-component-annotationsUpgrade maven-wagonUpgrade jboss-interceptors-1.2-apiUpgrade maven-openjdk11Upgrade maven-wagon-fileUpgrade maven-openjdk17Upgrade maven-resolver-transport-wagonUpgrade maven-libUpgrade plexus-sec-dispatcherUpgrade httpcomponents-coreUpgrade hawtjni-runtimeUpgrade plexus-cipherUpgrade sisuUpgrade maven-wagon-provider-apiUpgrade jsr-305Upgrade apache-commons-lang3Upgrade maven-resolver-implUpgrade plexus-utilsUpgrade jansiUpgrade jcl-over-slf4jUpgrade maven-shared-utils-javadocUpgrade maven-resolver-connector-basicUpgrade apache-commons-codecUpgrade slf4jUpgrade plexus-classworldsUpgrade maven-resolver-spiUpgrade aopallianceUpgrade mavenUpgrade maven-wagon-httpUpgrade maven-openjdk8Upgrade httpcomponents-clientUpgrade guavaUpgrade maven-resolver-utilUpgrade jansi-nativeUpgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade maven-resolverUpgrade google-guiceUpgrade geronimo-annotationUpgrade guava20Upgrade maven-resolver-apiUpgrade jsoupUpgrade maven-wagon-http-sharedUpgrade atinjectUpgrade maven-shared-utilsUpgrade sisu-plexusUpgrade plexus-interpolation | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade apache-commons-lang3Upgrade sisu-plexusUpgrade jsoupUpgrade jcl-over-slf4jUpgrade maven-wagon-fileUpgrade plexus-sec-dispatcherUpgrade maven-resolver-implUpgrade maven-resolver-connector-basicUpgrade apache-commons-ioUpgrade guavaUpgrade cdi-apiUpgrade plexus-classworldsUpgrade jsr-305Upgrade maven-libUpgrade plexus-cipherUpgrade maven-resolver-utilUpgrade sisuUpgrade maven-openjdk17Upgrade mavenUpgrade maven-openjdk8Upgrade maven-wagon-http-sharedUpgrade plexus-interpolationUpgrade geronimo-annotationUpgrade maven-wagonUpgrade maven-shared-utils-javadocUpgrade hawtjni-runtimeUpgrade maven-resolver-apiUpgrade glassfish-el-apiUpgrade maven-openjdk11Upgrade guava20Upgrade httpcomponents-clientUpgrade plexus-utilsUpgrade slf4jUpgrade apache-commons-loggingUpgrade sisu-injectUpgrade maven-wagon-httpUpgrade jansi-nativeUpgrade apache-commons-codecUpgrade google-guiceUpgrade plexus-containers-component-annotationsUpgrade maven-resolver-spiUpgrade maven-shared-utilsUpgrade aopallianceUpgrade httpcomponents-coreUpgrade atinjectUpgrade jboss-interceptors-1.2-apiUpgrade maven-wagon-provider-apiUpgrade maven-resolverUpgrade maven-resolver-transport-wagonUpgrade jansiUpgrade apache-commons-cli | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-antrun-plugin-javadocUpgrade maven-common-artifact-filtersUpgrade maven-dependency-tree-javadocUpgrade maven-dependency-pluginUpgrade maven-plugin-testing-toolsUpgrade xml-maven-pluginUpgrade maven-wagon-http-lightweightUpgrade javacc-maven-pluginUpgrade maven-wagon-fileUpgrade maven-mapping-javadocUpgrade maven-doxia-logging-apiUpgrade maven-doxia-javadocUpgrade maven-wagon-http-sharedUpgrade maven-localUpgrade maven-doxia-sitetools-javadocUpgrade maven-doxia-module-aptUpgrade maven-jar-pluginUpgrade maven-plugin-build-helper-javadocUpgrade maven-plugin-annotationsUpgrade paranamer-maven-pluginUpgrade maven-javadoc-plugin-javadocUpgrade maven-resolver-utilUpgrade maven-plugin-testing-javadocUpgrade maven-clean-plugin-javadocUpgrade maven-resolver-transport-classpathUpgrade maven-doxia-sink-apiUpgrade maven-wagon-ssh-externalUpgrade maven-artifact-managerUpgrade maven-resources-pluginUpgrade maven-doxia-coreUpgrade maven-surefireUpgrade maven-surefire-pluginUpgrade gmavenplus-pluginUpgrade maven-reporting-apiUpgrade maven-wagon-javadocUpgrade maven-install-plugin-javadocUpgrade maven-enforcer-pluginUpgrade maven-resolver-implUpgrade maven-shared-utilsUpgrade maven-plugin-plugin-javadocUpgrade maven-plugin-bundle-javadocUpgrade maven-modelUpgrade maven-plugin-tools-apiUpgrade maven-plugin-tools-javadocUpgrade maven-plugin-plugin-bootstrapUpgrade spec-version-maven-pluginUpgrade maven-javadoc-pluginUpgrade maven-plugin-testing-harnessUpgrade maven-reporting-api-javadocUpgrade maven-resolver-transport-httpUpgrade string-template-maven-pluginUpgrade javacc-maven-plugin-javadocUpgrade modello-maven-pluginUpgrade maven-assembly-plugin-javadocUpgrade maven-shared-ioUpgrade maven-clean-pluginUpgrade maven-enforcerUpgrade maven-enforcer-apiUpgrade maven-surefire-plugins-javadocUpgrade maven-assembly-pluginUpgrade os-maven-pluginUpgrade maven-source-pluginUpgrade maven-file-managementUpgrade maven-remote-resources-pluginUpgrade maven-shared-incrementalUpgrade maven-plugin-testingUpgrade maven-plugin-tools-antUpgrade maven-file-management-javadocUpgrade maven-resolver-transport-wagonUpgrade maven-archiverUpgrade exec-maven-plugin-javadocUpgrade maven-doxia-module-foUpgrade maven-profileUpgrade maven-projectUpgrade maven-shared-incremental-javadocUpgrade maven-doxia-module-twikiUpgrade maven-plugin-bundleUpgrade maven-common-artifact-filters-javadocUpgrade maven-failsafe-pluginUpgrade maven-archiver-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade maven-surefire-report-parserUpgrade maven-doxia-module-rtfUpgrade spec-version-maven-plugin-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-invokerUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-plugin-build-helperUpgrade maven-compiler-plugin-bootstrapUpgrade maven-compiler-plugin-javadocUpgrade bnd-maven-plugin-javadocUpgrade maven-surefire-provider-junitUpgrade maven-resolver-apiUpgrade maven-surefire-javadocUpgrade maven-plugin-tools-beanshellUpgrade maven-filtering-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-filteringUpgrade maven-antrun-pluginUpgrade maven-doxia-module-confluenceUpgrade maven-dependency-analyzerUpgrade maven-doxia-test-docsUpgrade maven-artifact-resolverUpgrade maven-doxia-module-xhtmlUpgrade maven-verifierUpgrade maven-resolver-javadocUpgrade maven-doxia-module-latexUpgrade maven-doxia-module-docbook-simpleUpgrade maven-plugin-pluginUpgrade maven-monitorUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-wagon-sshUpgrade maven-plugin-tools-generatorsUpgrade maven-resources-plugin-javadocUpgrade maven-dependency-analyzer-javadocUpgrade maven-invoker-javadocUpgrade maven-shared-utils-javadocUpgrade maven-resolver-test-utilUpgrade maven-surefire-report-pluginUpgrade maven-wagon-ftpUpgrade maven-surefire-provider-junit5Upgrade maven-resources-plugin-bootstrapUpgrade maven-resolver-connector-basicUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-doxia-module-xdocUpgrade gmavenplus-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade string-template-maven-plugin-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-enforcer-rulesUpgrade maven-test-toolsUpgrade maven-resolverUpgrade maven-enforcer-javadocUpgrade maven-resolver-named-locksUpgrade hawtjni-maven-plugin-javadocUpgrade maven2-javadocUpgrade maven-script-antUpgrade maven-plugin-descriptorUpgrade maven-artifactUpgrade exec-maven-pluginUpgrade maven-libUpgrade maven-source-plugin-javadocUpgrade maven-jar-plugin-javadocUpgrade maven-jar-plugin-bootstrapUpgrade maven-dependency-treeUpgrade maven-wagon-httpUpgrade maven-surefire-provider-testngUpgrade maven-resolver-transport-fileUpgrade maven-plugin-tools-javaUpgrade maven-toolchainUpgrade bnd-maven-pluginUpgrade maven-install-pluginUpgrade tesla-polyglot-maven-pluginUpgrade maven-plugin-tools-modelUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-plugin-registryUpgrade maven-wagon-ssh-commonUpgrade hawtjni-maven-pluginUpgrade maven-compiler-pluginUpgrade maven-settingsUpgrade maven-verifier-javadocUpgrade maven-surefire-plugin-bootstrapUpgrade maven-script-beanshellUpgrade antlr4-maven-pluginUpgrade xml-maven-plugin-javadocUpgrade maven-doxia-module-fmlUpgrade maven-mappingUpgrade maven-artifact-resolver-javadocUpgrade maven-artifact-transferUpgrade mavenUpgrade maven-wagon-provider-apiUpgrade maven-shared-io-javadocUpgrade maven-resolver-spiUpgrade maven-javadoc | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub