CVE-2021-28472

published 2021-04-13

CVE-2021-28472: Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability

Priority P3 57 high 7.8 CVSS 3.1

AV L AC L PR N UI R S U C H I H A H

Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	visual_studio_code_maven_for_java_extension	< publication	publication
microsoft	vscode-maven	< 0.29.0	0.29.0
msrc	visual_studio_code_maven_for_java_extension	—	—

Detection & IOCs extracted from sources · hover to see the quote

• · No technical exploitation details, PoC, or indicators of compromise are publicly available for this CVE. Microsoft has confirmed it has NOT been publicly disclosed or exploited in the wild, and exploitation is rated 'Less Likely' for all software releases. ↗
• · The affected component is the Visual Studio Code Maven for Java Extension. Remediation is via the extension's release notes/update on the VS Code Marketplace. ↗

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

vendor_msrc 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.