maven-shared-utils: Command injection via Commandline class

🗓️ 30 Oct 2023 13:03:06Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Flaw in maven shared utils enables command injection due to improper escaping in the Commandline class.

Reporter	Title	Published	Views	Family All 164
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect the IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit	30 Jun 202309:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Maven affect IBM watsonx.data	18 Sep 202419:42	–	ibm
ATTACKERKB	CVE-2022-29599	23 May 202211:16	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : maven-shared-utils, maven-shared-utils-javadoc (ALAS2022-2022-060)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : maven-shared-utils (ALAS2022-2022-242)	10 Dec 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : maven-shared-utils, maven-shared-utils-javadoc (ALAS2023-2023-077)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : maven-shared-utils (ALAS-2022-1794)	5 May 202200:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0160: maven:3.6 (ALINUX3-SA-2022:0160)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : maven:3.6 (ALSA-2022:4797)	6 Jun 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : maven:3.5 (ALSA-2022:4798)	6 Jun 202200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins-2-plugins	4.13.1698292274-1.el8	jenkins-2-plugins-4.13.1698292274-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-29599
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29599
cve	www.cve.org/CVERecord

19 Jul 2026 20:56Current

7.3High risk

Vulners AI Score7.3

CVSS 27.5

CVSS 3.19.8

EPSS0.04298

maven shared utils command injection command line class improper escaping shell injection unix