CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47197 – Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials
https://notcve.org/view.php?id=CVE-2024-47197
Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype integration testing creates a file called ./target/classes/archetype-it/archetype-settings.xml This file contains all the content from the users ~/.m2/settings.xml file, which often contains information they do not want to publish. We expect that on many developer machines, this also contains credentials. When the user runs mvn verify again (without a mvn clean), this file becomes part of the final artifact. If a developer were to publish this into Maven Central or any other remote repository (whether as a release or a snapshot) their credentials would be published without them knowing. • https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-922: Insecure Storage of Sensitive Information •
CVSS: 9.8EPSS: 2%CPEs: 3EXPL: 0CVE-2022-29599 – Commandline class shell injection vulnerabilities
https://notcve.org/view.php?id=CVE-2022-29599
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. En Apache Maven maven-shared-utils versiones anteriores a 3.3.3, la clase Commandline puede emitir cadenas con comillas dobles sin un escape apropiado, permitiendo ataques de inyección de shell A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack. • http://www.openwall.com/lists/oss-security/2022/05/23/3 https://github.com/apache/maven-shared-utils/pull/40 https://issues.apache.org/jira/browse/MSHARED-297 https://lists.debian.org/debian-lts-announce/2022/08/msg00018.html https://www.debian.org/security/2022/dsa-5242 https://access.redhat.com/security/cve/CVE-2022-29599 https://bugzilla.redhat.com/show_bug.cgi?id=2066479 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1CVE-2021-26291 – block repositories using http by default
https://notcve.org/view.php?id=CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html Apache Maven seguirá los repositorios que se definen en el Project Object Model (pom) de una dependencia, lo que puede resultar sorprendente para algunos usuarios, resultando en un riesgo potencial si un actor malicioso se hace cargo de ese repositorio o es capaz de insertarse en una posición para fingir ser ese repositorio. • http://www.openwall.com/lists/oss-security/2021/04/23/5 https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8aff5ee9bac7854d64736%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c%40%3Cdev.maven.apache.org%3E https://lists.apache.org/thread.html/r07a89b32783f73bda6903c1f9aadeb859e5bef0a4daed6d87db8e4a9%40%3Cissues.karaf.apache.org%3E https://lists.apache.org/thread.html/r08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E https://lists • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0253 – maven-wagon: all SSL certificate checking is disabled by default
https://notcve.org/view.php?id=CVE-2013-0253
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack. La configuración por defecto de Apache Maven v3.0.4, cuando se usa Maven Wagon v2.1 deshabilita los controles de certificado SSL, lo que permite a atacantes remotos suplantar a servidoresa través de ataques Man-in-the-middle (MITM). • http://rhn.redhat.com/errata/RHSA-2013-0700.html https://bugzilla.redhat.com/show_bug.cgi?id=917084 https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://maven.apache.org/security.html https://access.redhat.com/security/cve/CVE-2013-0253 • CWE-16: Configuration •