{"id":"GHSA-8vhq-qq4p-grq3","summary":"OS Command Injection in Plexus-utils","details":"Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.","aliases":["CVE-2017-1000487","SNYK-JAVA-ORGCODEHAUSPLEXUS-31522"],"modified":"2026-05-07T04:41:10.534384799Z","published":"2022-05-13T01:11:53Z","database_specific":{"cwe_ids":["CWE-78"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2022-07-01T21:47:32Z","nvd_published_at":"2018-01-03T20:29:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000487"},{"type":"WEB","url":"https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41"},{"type":"WEB","url":"https://www.debian.org/security/2018/dsa-4149"},{"type":"WEB","url":"https://www.debian.org/security/2018/dsa-4146"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00011.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00010.html"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62@%3Cdev.avro.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62%40%3Cdev.avro.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E"},{"type":"PACKAGE","url":"https://github.com/codehaus-plexus/plexus-utils"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1322"}],"affected":[{"package":{"name":"org.codehaus.plexus:plexus-utils","ecosystem":"Maven","purl":"pkg:maven/org.codehaus.plexus/plexus-utils"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16"}]}],"versions":["1.0.4","1.0.5","1.1","1.2","1.3","1.4","1.4-alpha-1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8vhq-qq4p-grq3/GHSA-8vhq-qq4p-grq3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}