CVE-2017-1000487

  1. Reconshell
  2. Vulnerabilities (CVE)
  3. CVE-2017-1000487
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522 Patch Third Party Advisory
https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00010.html Mailing List Third Party Advisory
https://www.debian.org/security/2018/dsa-4146 Third Party Advisory
https://www.debian.org/security/2018/dsa-4149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1322 Third Party Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62@%3Cdev.avro.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@%3Ccommits.pulsar.apache.org%3E Mailing List Third Party Advisory
Advertisement

NeevaHost hosting service
Configurations

Configuration 1 (hide)

cpe:2.3:a:plexus-utils_project:plexus-utils:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Information

Published : 2018-01-03 12:29

Updated : 2021-01-28 10:11

NVD link : CVE-2017-1000487

Mitre link : CVE-2017-1000487

JSON object : View

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Advertisement

dedicated server usa
Products Affected

debian

  • debian_linux

plexus-utils_project

  • plexus-utils