Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Commons Text | — | Upgrade Apache Commons Text to latest | Oct 18, 2022 | Oct 13, 2022 |
| Centos_linux | — | Upgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-highlineUpgrade satellite-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cloneUpgrade satellite-maintainUpgrade rubygem-netrcUpgrade rubygem-oauth-ttyUpgrade rubygem-unicodeUpgrade rubygem-ffiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindingsUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-gssapiUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_openscap | Jan 19, 2023 | Oct 13, 2022 |
| Debian | — | Upgrade commons-text | Jul 30, 2024 | Oct 13, 2022 |
| Dell Powerstore Dsa2025182 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Apr 17, 2025 |
| Gentoo Linux | — | Upgrade dev-java/commons-text. | Jan 12, 2023 | Oct 13, 2022 |
| Red Hat Jboss Eap | — | — | Jul 9, 2025 | Oct 13, 2022 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Apr 10, 2023 | Oct 13, 2022 |
| Redhat_linux | — | Upgrade rubygem-localeUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade python39-pulp_manifestUpgrade rubygem-unicodeUpgrade rubygem-highlineUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-http-cookieUpgrade rubygem-clampUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-multi_jsonUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-typesUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindings | Jan 19, 2023 | Oct 13, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Oct 13, 2022 |
| Suse | — | Upgrade apache-commons-text-javadocUpgrade apache-commons-text | Mar 20, 2023 | Oct 13, 2022 |
| Ubuntu | — | No solution exists | Jul 29, 2025 | Oct 13, 2022 |
| Zoho Manageengine Pam360 | — | Upgrade Zoho ManageEngine PAM360 to the latest version | Jul 2, 2025 | Oct 13, 2022 |
| Zoho Manageengine Passwordmanager Pro | — | Upgrade Zoho ManageEngine PasswordManager Pro to the latest version | Dec 23, 2024 | Oct 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub