Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_extUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-domain_nameUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-version_gemUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade foreman-cliUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-data | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade rubygem-highlineUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauthUpgrade rubygem-rest-clientUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-fast_gettextUpgrade rubygem-version_gemUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cliUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-ffi-debuginfoUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-jwtUpgrade rubygem-multi_jsonUpgrade rubygem-unfUpgrade rubygem-snaky_hashUpgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauth-ttyUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_ansible | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub