In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jsr-305Upgrade hawtjni-runtimeUpgrade apache-commons-lang3Upgrade slf4jUpgrade jcl-over-slf4jUpgrade maven-wagonUpgrade apache-commons-cliUpgrade apache-commons-codecUpgrade sisu-plexusUpgrade plexus-sec-dispatcherUpgrade maven-resolver-connector-basicUpgrade maven-openjdk8Upgrade plexus-cipherUpgrade jansiUpgrade plexus-containers-component-annotationsUpgrade maven-libUpgrade maven-resolver-apiUpgrade sisuUpgrade cdi-apiUpgrade apache-commons-ioUpgrade maven-openjdk17Upgrade apache-commons-loggingUpgrade maven-wagon-fileUpgrade maven-openjdk11Upgrade google-guiceUpgrade maven-resolver-spiUpgrade maven-resolver-utilUpgrade mavenUpgrade geronimo-annotationUpgrade plexus-utilsUpgrade guava20Upgrade sisu-injectUpgrade guavaUpgrade maven-wagon-http-sharedUpgrade jboss-interceptors-1.2-apiUpgrade maven-resolver-implUpgrade maven-resolver-transport-wagonUpgrade atinjectUpgrade httpcomponents-coreUpgrade maven-resolverUpgrade plexus-interpolationUpgrade plexus-classworldsUpgrade httpcomponents-clientUpgrade jansi-nativeUpgrade maven-wagon-provider-apiUpgrade glassfish-el-apiUpgrade aopallianceUpgrade maven-shared-utilsUpgrade jsoupUpgrade maven-wagon-http | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utils-javadocUpgrade maven-shared-utils | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade jansi-nativeUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade maven-openjdk8Upgrade geronimo-annotationUpgrade httpcomponents-coreUpgrade hawtjni-runtimeUpgrade plexus-containers-component-annotationsUpgrade maven-libUpgrade maven-resolver-connector-basicUpgrade mavenUpgrade maven-wagon-httpUpgrade maven-resolver-apiUpgrade sisu-injectUpgrade maven-resolverUpgrade plexus-classworldsUpgrade apache-commons-loggingUpgrade jcl-over-slf4jUpgrade jsoupUpgrade jsr-305Upgrade atinjectUpgrade apache-commons-cliUpgrade apache-commons-ioUpgrade apache-commons-lang3Upgrade google-guiceUpgrade maven-openjdk11Upgrade guava20Upgrade maven-shared-utilsUpgrade cdi-apiUpgrade sisu-plexusUpgrade maven-openjdk17Upgrade maven-shared-utils-javadocUpgrade maven-wagonUpgrade aopallianceUpgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade maven-wagon-fileUpgrade glassfish-el-apiUpgrade httpcomponents-clientUpgrade plexus-cipherUpgrade jansiUpgrade maven-resolver-transport-wagonUpgrade slf4jUpgrade maven-resolver-utilUpgrade apache-commons-codecUpgrade sisuUpgrade plexus-utilsUpgrade guavaUpgrade maven-resolver-implUpgrade jboss-interceptors-1.2-apiUpgrade plexus-sec-dispatcher | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade maven-shared-utils-javadocUpgrade jcl-over-slf4jUpgrade plexus-utilsUpgrade jboss-interceptors-1.2-apiUpgrade hawtjni-runtimeUpgrade maven-openjdk17Upgrade sisu-injectUpgrade maven-resolver-transport-wagonUpgrade plexus-containers-component-annotationsUpgrade plexus-sec-dispatcherUpgrade maven-wagon-fileUpgrade httpcomponents-coreUpgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade cdi-apiUpgrade glassfish-el-apiUpgrade maven-wagon-provider-apiUpgrade maven-resolver-implUpgrade slf4jUpgrade apache-commons-codecUpgrade sisuUpgrade jsr-305Upgrade maven-libUpgrade jansiUpgrade maven-wagonUpgrade plexus-cipherUpgrade maven-openjdk11Upgrade maven-resolver-connector-basicUpgrade aopallianceUpgrade maven-shared-utilsUpgrade mavenUpgrade sisu-plexusUpgrade httpcomponents-clientUpgrade guavaUpgrade apache-commons-loggingUpgrade apache-commons-cliUpgrade maven-wagon-httpUpgrade maven-resolver-utilUpgrade maven-openjdk8Upgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade jsoupUpgrade maven-resolver-apiUpgrade maven-wagon-http-sharedUpgrade google-guiceUpgrade guava20Upgrade geronimo-annotationUpgrade plexus-classworldsUpgrade maven-resolverUpgrade jansi-nativeUpgrade atinject | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade plexus-sec-dispatcherUpgrade jsr-305Upgrade maven-resolver-apiUpgrade geronimo-annotationUpgrade jcl-over-slf4jUpgrade apache-commons-lang3Upgrade maven-libUpgrade maven-wagonUpgrade hawtjni-runtimeUpgrade maven-resolver-connector-basicUpgrade jsoupUpgrade maven-wagon-fileUpgrade sisu-plexusUpgrade maven-openjdk17Upgrade maven-wagon-http-sharedUpgrade apache-commons-ioUpgrade glassfish-el-apiUpgrade maven-resolver-utilUpgrade maven-shared-utils-javadocUpgrade maven-resolver-implUpgrade guavaUpgrade plexus-interpolationUpgrade cdi-apiUpgrade maven-openjdk8Upgrade maven-openjdk11Upgrade sisuUpgrade plexus-cipherUpgrade mavenUpgrade plexus-classworldsUpgrade jboss-interceptors-1.2-apiUpgrade aopallianceUpgrade google-guiceUpgrade maven-wagon-httpUpgrade atinjectUpgrade apache-commons-codecUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade maven-shared-utilsUpgrade jansi-nativeUpgrade httpcomponents-clientUpgrade maven-wagon-provider-apiUpgrade guava20Upgrade slf4jUpgrade apache-commons-loggingUpgrade httpcomponents-coreUpgrade plexus-containers-component-annotationsUpgrade sisu-injectUpgrade plexus-utilsUpgrade jansiUpgrade apache-commons-cliUpgrade maven-resolver-transport-wagon | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-install-pluginUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-plugin-pluginUpgrade os-maven-plugin-javadocUpgrade maven-resources-plugin-bootstrapUpgrade maven-wagon-ftpUpgrade hawtjni-maven-plugin-javadocUpgrade string-template-maven-plugin-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-doxia-module-xdocUpgrade maven-enforcer-rulesUpgrade maven-remote-resources-plugin-javadocUpgrade maven-filtering-javadocUpgrade maven-toolchainUpgrade maven-doxia-module-confluenceUpgrade bnd-maven-pluginUpgrade maven-plugin-descriptorUpgrade maven-artifact-transferUpgrade maven-resolver-spiUpgrade maven-surefire-plugin-bootstrapUpgrade maven-resolver-named-locksUpgrade maven-plugin-tools-modelUpgrade maven-doxia-module-fmlUpgrade maven-settingsUpgrade maven-source-plugin-javadocUpgrade maven-script-antUpgrade maven-enforcer-javadocUpgrade maven-resolverUpgrade maven-artifactUpgrade maven-libUpgrade maven2-javadocUpgrade maven-verifier-javadocUpgrade gmavenplus-plugin-javadocUpgrade maven-shared-io-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-compiler-pluginUpgrade maven-javadocUpgrade maven-plugin-tools-annotationsUpgrade bnd-maven-plugin-javadocUpgrade maven-plugin-tools-beanshellUpgrade maven-resolver-apiUpgrade maven-compiler-plugin-bootstrapUpgrade maven-compiler-plugin-javadocUpgrade antlr4-maven-pluginUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-invokerUpgrade exec-maven-pluginUpgrade mavenUpgrade maven-resolver-transport-fileUpgrade maven-jar-plugin-bootstrapUpgrade maven-plugin-tools-javaUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-wagon-httpUpgrade maven-jar-plugin-javadocUpgrade maven-test-toolsUpgrade maven-surefire-provider-testngUpgrade maven-mappingUpgrade maven-dependency-treeUpgrade maven-plugin-build-helperUpgrade maven-dependency-analyzer-javadocUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-artifact-resolver-javadocUpgrade maven-wagon-ssh-commonUpgrade maven-surefire-javadocUpgrade maven-surefire-provider-junitUpgrade hawtjni-maven-pluginUpgrade tesla-polyglot-maven-pluginUpgrade maven-wagon-provider-apiUpgrade maven-resolver-javadocUpgrade maven-resolver-connector-basicUpgrade maven-doxia-module-docbook-simpleUpgrade xml-maven-plugin-javadocUpgrade maven-plugin-registryUpgrade maven-antrun-pluginUpgrade maven-dependency-analyzerUpgrade maven-doxia-module-xhtml5Upgrade maven-filteringUpgrade maven-wagon-sshUpgrade maven-resources-plugin-javadocUpgrade maven-artifact-resolverUpgrade maven-doxia-module-xhtmlUpgrade maven-surefire-report-pluginUpgrade maven-shared-utils-javadocUpgrade maven-resolver-test-utilUpgrade maven-verifierUpgrade maven-doxia-module-latexUpgrade maven-doxia-test-docsUpgrade modello-maven-plugin-javadocUpgrade maven-invoker-javadocUpgrade maven-monitorUpgrade maven-script-beanshellUpgrade maven-plugin-tools-generatorsUpgrade os-maven-pluginUpgrade spec-version-maven-plugin-javadocUpgrade maven-wagon-fileUpgrade exec-maven-plugin-javadocUpgrade maven-doxia-module-foUpgrade maven-archiverUpgrade maven-file-managementUpgrade maven-resolver-transport-wagonUpgrade maven-plugin-tools-antUpgrade maven-doxia-module-aptUpgrade maven-doxia-coreUpgrade maven-artifact-managerUpgrade maven-file-management-javadocUpgrade maven-plugin-testingUpgrade maven-wagon-http-lightweightUpgrade maven-plugin-testing-toolsUpgrade maven-wagon-http-sharedUpgrade maven-resolver-transport-httpUpgrade maven-plugin-bundle-javadocUpgrade maven-doxia-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-shared-ioUpgrade spec-version-maven-pluginUpgrade maven-plugin-tools-apiUpgrade maven-modelUpgrade maven-mapping-javadocUpgrade maven-dependency-pluginUpgrade maven-plugin-tools-javadocUpgrade javacc-maven-pluginUpgrade maven-doxia-sink-apiUpgrade xml-maven-pluginUpgrade maven-doxia-logging-apiUpgrade maven-localUpgrade maven-archiver-javadocUpgrade maven-surefire-plugins-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-profileUpgrade maven-assembly-pluginUpgrade javacc-maven-plugin-javadocUpgrade string-template-maven-pluginUpgrade modello-maven-pluginUpgrade maven-enforcerUpgrade maven-clean-pluginUpgrade maven-reporting-api-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-javadoc-pluginUpgrade maven-assembly-plugin-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-plugin-testing-harnessUpgrade maven-shared-incrementalUpgrade maven-source-pluginUpgrade maven-resolver-implUpgrade maven-install-plugin-javadocUpgrade maven-plugin-plugin-bootstrapUpgrade maven-resources-pluginUpgrade maven-common-artifact-filtersUpgrade maven-surefire-pluginUpgrade maven-antrun-plugin-javadocUpgrade maven-wagon-javadocUpgrade maven-surefireUpgrade maven-plugin-testing-javadocUpgrade maven-surefire-report-parserUpgrade maven-shared-incremental-javadocUpgrade maven-doxia-module-rtfUpgrade maven-projectUpgrade maven-plugin-bundleUpgrade maven-doxia-module-twikiUpgrade maven-artifact-transfer-javadocUpgrade maven-failsafe-pluginUpgrade gmavenplus-pluginUpgrade maven-dependency-tree-javadocUpgrade maven-shared-utilsUpgrade paranamer-maven-pluginUpgrade maven-enforcer-pluginUpgrade maven-plugin-annotationsUpgrade maven-resolver-transport-classpathUpgrade maven-javadoc-plugin-javadocUpgrade maven-clean-plugin-javadocUpgrade maven-wagon-ssh-externalUpgrade maven-doxia-sitetools-javadocUpgrade maven-jar-pluginUpgrade maven-reporting-apiUpgrade maven-resolver-utilUpgrade maven-remote-resources-plugin | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-javaUpgrade libmaven-shared-utils-java (Ubuntu Pro) | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub