Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade satellite-cloneUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-unicode-debuginfoUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-clientUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-powerbarUpgrade rubygem-ffi-debugsourceUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade python39-pulp_manifestUpgrade rubygem-version_gemUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-acceptUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_execution | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debugsourceUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade rubygem-gssapiUpgrade python39-pulp_manifestUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-version_gemUpgrade rubygem-mime-types-dataUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-amazing_print | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub