CVE-2017-1000487GHSA-8VHQ-QQ4P-GRQ3SNYK-JAVA-ORGCODEHAUSPLEXUS-31522
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.0.16
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- org.codehaus.plexus:plexus-utilsMaven
fixed in 3.0.16
References 12
access.redhat.com
GitHub · codehaus-plexus/plexus-utils
lists.apache.org
- thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@<commits.druid.apache.org>
- thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62@<dev.avro.apache.org>
- thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@<commits.pulsar.apache.org>
- thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@<commits.pulsar.apache.org>