Command injection in Apache Maven maven-shared-utils

CRÍTICO 9.8CVE-2022-29599 · GHSA-rhgr-952r-6p8q · Published 23/05/2022 · updated 17/06/2026

En resumen

CVE-2022-29599 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.apache.maven.shared:maven-shared-utils, maven shared utils (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 4.4%, mayor que el 91.4% de las vulnerabilidades.
Solución: actualizar a 3.3.3 o posterior.

Package	Affected versions	Patched versions
org.apache.maven.shared:maven-shared-utils Maven	`< 3.3.3`	`3.3.3`
maven shared utils apache	`< 3.3.3`	`3.3.3`

Description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

NVD description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

References

nvd.nist.gov/vuln/detail/CVE-2022-29599 · ADVISORY
apache/maven-shared-utils#40 · WEB
apache/maven-shared-utils · PACKAGE
issues.apache.org/jira/browse/MSHARED-297 · WEB
lists.debian.org/debian-lts-announce/2022/08/msg00018.html · WEB
debian.org/security/2022/dsa-5242 · WEB
openwall.com/lists/oss-security/2022/05/23/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free