Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade satellite-cliUpgrade foreman-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade rubygem-apipie-bindingsUpgrade rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-ffiUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-gssapiUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-jwtUpgrade python39-pulp_manifestUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-powerbarUpgrade rubygem-version_gemUpgrade rubygem-http-cookieUpgrade rubygem-http-acceptUpgrade rubygem-clampUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-types | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauth-ttyUpgrade satellite-cloneUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-little-pluggerUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-acceptUpgrade rubygem-apipie-bindingsUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cliUpgrade rubygem-oauthUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-localeUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-hashie | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub