Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-rest-clientUpgrade rubygem-little-pluggerUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade python39-pulp_manifestUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-gssapiUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-clampUpgrade rubygem-powerbarUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-localeUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_azure_rm | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-mime-types-dataUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_extUpgrade rubygem-version_gemUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-multi_jsonUpgrade rubygem-snaky_hashUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-acceptUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-powerbarUpgrade rubygem-ffi-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-cloneUpgrade rubygem-mime-typesUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-unicode-debugsourceUpgrade rubygem-jwt | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub