In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-resolver-connector-basicUpgrade maven-libUpgrade maven-wagonUpgrade jansiUpgrade apache-commons-cliUpgrade jcl-over-slf4jUpgrade apache-commons-lang3Upgrade jsr-305Upgrade sisuUpgrade cdi-apiUpgrade apache-commons-ioUpgrade maven-resolver-apiUpgrade plexus-sec-dispatcherUpgrade plexus-containers-component-annotationsUpgrade sisu-plexusUpgrade maven-openjdk17Upgrade apache-commons-loggingUpgrade apache-commons-codecUpgrade plexus-cipherUpgrade maven-openjdk8Upgrade maven-openjdk11Upgrade hawtjni-runtimeUpgrade maven-wagon-fileUpgrade slf4jUpgrade guava20Upgrade jsoupUpgrade guavaUpgrade httpcomponents-coreUpgrade geronimo-annotationUpgrade plexus-utilsUpgrade plexus-classworldsUpgrade maven-wagon-httpUpgrade google-guiceUpgrade aopallianceUpgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade mavenUpgrade maven-wagon-provider-apiUpgrade maven-resolverUpgrade maven-resolver-implUpgrade sisu-injectUpgrade maven-wagon-http-sharedUpgrade maven-resolver-spiUpgrade jansi-nativeUpgrade glassfish-el-apiUpgrade maven-resolver-transport-wagonUpgrade maven-resolver-utilUpgrade atinjectUpgrade plexus-interpolationUpgrade httpcomponents-client | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utils-javadocUpgrade maven-shared-utils | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade mavenUpgrade google-guiceUpgrade httpcomponents-coreUpgrade plexus-interpolationUpgrade maven-resolver-connector-basicUpgrade atinjectUpgrade maven-resolver-spiUpgrade jsr-305Upgrade maven-wagon-httpUpgrade hawtjni-runtimeUpgrade plexus-classworldsUpgrade plexus-containers-component-annotationsUpgrade maven-resolverUpgrade maven-resolver-apiUpgrade maven-openjdk11Upgrade geronimo-annotationUpgrade apache-commons-loggingUpgrade jcl-over-slf4jUpgrade jsoupUpgrade jansi-nativeUpgrade maven-libUpgrade sisu-injectUpgrade apache-commons-ioUpgrade apache-commons-lang3Upgrade maven-openjdk8Upgrade apache-commons-cliUpgrade aopallianceUpgrade glassfish-el-apiUpgrade plexus-sec-dispatcherUpgrade guavaUpgrade maven-resolver-transport-wagonUpgrade plexus-cipherUpgrade jansiUpgrade httpcomponents-clientUpgrade maven-shared-utils-javadocUpgrade sisu-plexusUpgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade guava20Upgrade maven-wagon-provider-apiUpgrade maven-wagon-http-sharedUpgrade maven-wagon-fileUpgrade maven-wagonUpgrade maven-openjdk17Upgrade cdi-apiUpgrade maven-resolver-utilUpgrade maven-resolver-implUpgrade slf4jUpgrade apache-commons-codecUpgrade sisuUpgrade plexus-utils | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade geronimo-annotationUpgrade google-guiceUpgrade maven-shared-utilsUpgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade maven-resolver-spiUpgrade sisu-plexusUpgrade maven-resolver-utilUpgrade plexus-interpolationUpgrade guavaUpgrade aopallianceUpgrade atinjectUpgrade plexus-classworldsUpgrade httpcomponents-clientUpgrade maven-wagon-httpUpgrade maven-openjdk8Upgrade maven-wagon-http-sharedUpgrade mavenUpgrade maven-resolverUpgrade guava20Upgrade jansi-nativeUpgrade jsoupUpgrade maven-resolver-apiUpgrade hawtjni-runtimeUpgrade plexus-containers-component-annotationsUpgrade maven-shared-utils-javadocUpgrade maven-openjdk11Upgrade jboss-interceptors-1.2-apiUpgrade glassfish-el-apiUpgrade cdi-apiUpgrade sisu-injectUpgrade maven-resolver-transport-wagonUpgrade maven-wagon-fileUpgrade plexus-utilsUpgrade apache-commons-lang3Upgrade apache-commons-ioUpgrade maven-resolver-connector-basicUpgrade jcl-over-slf4jUpgrade slf4jUpgrade apache-commons-codecUpgrade httpcomponents-coreUpgrade plexus-sec-dispatcherUpgrade maven-openjdk17Upgrade maven-resolver-implUpgrade maven-wagonUpgrade maven-libUpgrade plexus-cipherUpgrade jsr-305Upgrade sisuUpgrade maven-wagon-provider-apiUpgrade jansi | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade plexus-classworldsUpgrade maven-openjdk8Upgrade maven-shared-utils-javadocUpgrade apache-commons-ioUpgrade maven-resolver-apiUpgrade plexus-cipherUpgrade hawtjni-runtimeUpgrade maven-openjdk11Upgrade sisuUpgrade jsoupUpgrade apache-commons-lang3Upgrade maven-wagon-http-sharedUpgrade maven-wagonUpgrade maven-resolver-utilUpgrade jsr-305Upgrade maven-libUpgrade maven-openjdk17Upgrade plexus-sec-dispatcherUpgrade maven-resolver-connector-basicUpgrade jcl-over-slf4jUpgrade sisu-plexusUpgrade maven-wagon-fileUpgrade mavenUpgrade cdi-apiUpgrade plexus-interpolationUpgrade geronimo-annotationUpgrade guavaUpgrade maven-resolver-implUpgrade glassfish-el-apiUpgrade jansi-nativeUpgrade maven-shared-utilsUpgrade guava20Upgrade slf4jUpgrade maven-wagon-provider-apiUpgrade plexus-containers-component-annotationsUpgrade maven-wagon-httpUpgrade httpcomponents-coreUpgrade apache-commons-codecUpgrade maven-resolverUpgrade maven-resolver-spiUpgrade aopallianceUpgrade apache-commons-cliUpgrade plexus-utilsUpgrade maven-resolver-transport-wagonUpgrade jboss-interceptors-1.2-apiUpgrade atinjectUpgrade jansiUpgrade google-guiceUpgrade sisu-injectUpgrade httpcomponents-clientUpgrade apache-commons-logging | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-shared-utilsUpgrade maven-wagon-ssh-externalUpgrade maven-doxia-logging-apiUpgrade maven-javadoc-pluginUpgrade maven-wagon-http-lightweightUpgrade os-maven-pluginUpgrade maven-reporting-api-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-surefireUpgrade maven-common-artifact-filtersUpgrade maven-dependency-tree-javadocUpgrade maven-file-management-javadocUpgrade maven-enforcer-pluginUpgrade maven-plugin-bundleUpgrade gmavenplus-pluginUpgrade maven-antrun-plugin-javadocUpgrade maven-resolver-implUpgrade maven-resources-pluginUpgrade maven-plugin-plugin-bootstrapUpgrade maven-doxia-module-twikiUpgrade maven-doxia-sink-apiUpgrade maven-wagon-javadocUpgrade maven-localUpgrade maven-wagon-http-sharedUpgrade maven-plugin-bundle-javadocUpgrade maven-doxia-sitetools-javadocUpgrade maven-jar-pluginUpgrade maven-surefire-pluginUpgrade javacc-maven-pluginUpgrade maven-install-plugin-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-doxia-module-aptUpgrade maven-wagon-fileUpgrade maven-resolver-utilUpgrade maven-artifact-managerUpgrade maven-reporting-apiUpgrade maven-doxia-coreUpgrade xml-maven-pluginUpgrade maven-plugin-testing-toolsUpgrade maven-plugin-plugin-javadocUpgrade maven-plugin-tools-apiUpgrade maven-remote-resources-pluginUpgrade maven-file-managementUpgrade maven-clean-plugin-javadocUpgrade maven-failsafe-pluginUpgrade paranamer-maven-pluginUpgrade maven-javadoc-plugin-javadocUpgrade maven-plugin-annotationsUpgrade spec-version-maven-plugin-javadocUpgrade maven-doxia-javadocUpgrade maven-plugin-testingUpgrade maven-resolver-transport-wagonUpgrade maven-shared-incrementalUpgrade maven-archiverUpgrade maven-doxia-module-foUpgrade maven-plugin-tools-antUpgrade maven-surefire-plugins-javadocUpgrade maven-projectUpgrade maven-surefire-report-parserUpgrade maven-profileUpgrade exec-maven-plugin-javadocUpgrade maven-artifact-transfer-javadocUpgrade maven-common-artifact-filters-javadocUpgrade maven-doxia-module-rtfUpgrade maven-resolver-transport-classpathUpgrade string-template-maven-pluginUpgrade javacc-maven-plugin-javadocUpgrade maven-shared-incremental-javadocUpgrade maven-assembly-pluginUpgrade maven-archiver-javadocUpgrade maven-plugin-testing-harnessUpgrade maven-dependency-pluginUpgrade maven-mapping-javadocUpgrade maven-clean-pluginUpgrade maven-dependency-plugin-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-enforcerUpgrade maven-enforcer-apiUpgrade maven-resolver-transport-httpUpgrade modello-maven-pluginUpgrade spec-version-maven-pluginUpgrade maven-modelUpgrade maven-source-pluginUpgrade maven-shared-ioUpgrade maven-plugin-tools-javadocUpgrade maven-doxia-module-xhtmlUpgrade maven-artifactUpgrade maven-mappingUpgrade maven-doxia-module-fmlUpgrade maven-enforcer-javadocUpgrade hawtjni-maven-plugin-javadocUpgrade exec-maven-pluginUpgrade maven2-javadocUpgrade maven-monitorUpgrade maven-doxia-module-docbook-simpleUpgrade maven-dependency-analyzerUpgrade maven-filteringUpgrade maven-doxia-test-docsUpgrade maven-dependency-analyzer-javadocUpgrade maven-plugin-tools-annotationsUpgrade maven-resolver-spiUpgrade maven-shared-io-javadocUpgrade maven-javadocUpgrade maven-invokerUpgrade maven-compiler-plugin-bootstrapUpgrade bnd-maven-plugin-javadocUpgrade maven-surefire-provider-junitUpgrade maven-compiler-plugin-javadocUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-plugin-tools-modelUpgrade maven-plugin-registryUpgrade maven-artifact-resolver-javadocUpgrade hawtjni-maven-pluginUpgrade tesla-polyglot-maven-pluginUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-resolver-apiUpgrade gmavenplus-plugin-javadocUpgrade maven-compiler-pluginUpgrade string-template-maven-plugin-javadocUpgrade maven-resolver-connector-basicUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-script-beanshellUpgrade bnd-maven-pluginUpgrade maven-wagon-ftpUpgrade maven-plugin-tools-javaUpgrade maven-resources-plugin-bootstrapUpgrade os-maven-plugin-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-doxia-module-xdocUpgrade maven-wagon-httpUpgrade maven-verifier-javadocUpgrade modello-maven-plugin-javadocUpgrade maven-resources-plugin-javadocUpgrade maven-resolver-test-utilUpgrade maven-invoker-javadocUpgrade maven-doxia-module-xhtml5Upgrade maven-artifact-resolverUpgrade maven-antrun-pluginUpgrade maven-doxia-module-confluenceUpgrade maven-plugin-tools-beanshellUpgrade maven-artifact-transferUpgrade maven-jar-plugin-bootstrapUpgrade maven-surefire-plugin-bootstrapUpgrade xml-maven-plugin-javadocUpgrade maven-plugin-build-helperUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-jar-plugin-javadocUpgrade maven-surefire-provider-testngUpgrade maven-test-toolsUpgrade maven-install-pluginUpgrade mavenUpgrade maven-plugin-pluginUpgrade maven-settingsUpgrade maven-enforcer-rulesUpgrade maven-resolver-transport-fileUpgrade maven-doxia-module-latexUpgrade maven-filtering-javadocUpgrade maven-toolchainUpgrade maven-dependency-treeUpgrade antlr4-maven-pluginUpgrade maven-wagon-provider-apiUpgrade maven-surefire-javadocUpgrade maven-source-plugin-javadocUpgrade maven-script-antUpgrade maven-resolverUpgrade maven-resolver-named-locksUpgrade maven-plugin-descriptorUpgrade maven-libUpgrade maven-wagon-ssh-commonUpgrade maven-surefire-report-pluginUpgrade maven-resolver-javadocUpgrade maven-shared-utils-javadocUpgrade maven-verifierUpgrade maven-wagon-sshUpgrade maven-plugin-tools-generators | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-javaUpgrade libmaven-shared-utils-java (Ubuntu Pro) | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub