CVE-2017-1000487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-1000487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-1000487
Aliases
Downstream
Related
  • SNYK-JAVA-ORGCODEHAUSPLEXUS-31522
Published
2018-01-03T20:29:00.703Z
Modified
2026-04-10T03:56:07.858350Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

References

Affected packages

Git / github.com/codehaus-plexus/plexus-utils

Affected ranges

Type
GIT
Repo
https://github.com/codehaus-plexus/plexus-utils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf317f9b4070c3c619e9ee75a3e38bea3ff621c1
Fixed
b38a1b3a4352303e4312b2bb601a0d7ec6e28f41
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.16"
        }
    ]
}

Affected versions

plexus-utils-2.*
plexus-utils-2.0.7
plexus-utils-2.1
plexus-utils-3.*
plexus-utils-3.0
plexus-utils-3.0.1
plexus-utils-3.0.10
plexus-utils-3.0.11
plexus-utils-3.0.12
plexus-utils-3.0.13
plexus-utils-3.0.14
plexus-utils-3.0.15
plexus-utils-3.0.2
plexus-utils-3.0.3
plexus-utils-3.0.4
plexus-utils-3.0.5
plexus-utils-3.0.6
plexus-utils-3.0.7
plexus-utils-3.0.8
plexus-utils-3.0.9

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000487.json"