CVE-2022-33980
published 2022-07-06CVE-2022-33980: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
42.65%
98.6th percentile
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_configuration | >= 2.4 < 2.8 | 2.8 |
| apache_software_foundation | apache_commons_configuration | >= Apache Commons Configuration < 2.8.0 | 2.8.0 |
| debian | commons-configuration2 | < commons-configuration2 2.8.0-1 (bookworm) | commons-configuration2 2.8.0-1 (bookworm) |
| debian | debian_linux | — | — |
| jenkins | associated_files_plugin | — | — |
| jenkins | bart_plugin | — | — |
| jenkins | cccc_plugin | — | — |
| jenkins | cluster_statistics_plugin | — | — |
| jenkins | config_rotator_plugin | — | — |
| jenkins | delete_log_plugin | — | — |
| jenkins | japex_plugin | — | — |
| jenkins | junit_plugin | — | — |
| jenkins | naginator_plugin | — | — |
| jenkins | ns-nd_integration_performance_publisher_plugin | — | — |
| jenkins | pipeline_utility_steps_plugin | — | — |
| jenkins | registry_notification_plugin | — | — |
| jenkins | reverse_proxy_auth_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | sourcemonitor_plugin | — | — |
| jenkins | support_core_plugin | — | — |
| jenkins | urls_in_the_plugin | — | — |
| jenkins | violations_plugin | — | — |
| jenkins | xml_linter_plugin | — | — |
| jenkins | xp-dev_plugin | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring configuration values or log entries containing the interpolation pattern '${prefix:name}', specifically with prefixes 'script', 'dns', or 'url', which are the dangerous default lookups enabled in Apache Commons Configuration 2.4–2.7. ↗
- →Alert on outbound DNS or HTTP/URL requests originating from the application process that correlate with configuration value evaluation — indicative of the 'dns' or 'url' lookup interpolators being triggered by untrusted input. ↗
- →Monitor for javax.script engine invocations (e.g., ScriptEngine.eval()) spawned from within the Apache Commons Configuration interpolation code path (org.apache.commons.configuration2.interpol.Lookup), which would indicate exploitation of the 'script' lookup. ↗
- →Flag applications running Apache Commons Configuration versions 2.4 through 2.7 as vulnerable; version 2.8.0 disables the dangerous interpolators by default and is the safe baseline. ↗
- ·The dangerous interpolators ('script', 'dns', 'url') are only active when using the interpolation defaults. Applications that do not expose untrusted input to configuration interpolation are not exploitable, as confirmed by Red Hat's assessment of several of its products. ↗
- ·Upgrading to Apache Commons Configuration 2.8.0 disables the problematic interpolators by default, but applications that explicitly re-enable 'script', 'dns', or 'url' lookups after upgrading would remain vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Code injection in Apache Commons Configuration
osv·2022-07-07
CVE-2022-33980 [CRITICAL] Code injection in Apache Commons Configuration
Code injection in Apache Commons Configuration
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in
GHSA
Code injection in Apache Commons Configuration
ghsa·2022-07-07
CVE-2022-33980 [CRITICAL] CWE-74 Code injection in Apache Commons Configuration
Code injection in Apache Commons Configuration
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in
OSV
CVE-2022-33980: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded
osv·2022-07-06·CVSS 9.8
CVE-2022-33980 [CRITICAL] CVE-2022-33980: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remot
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: UI (Apache Commons Configuration) — CVE-2022-33980
vendor_oracle·2023-10-15·CVSS 7.2
CVE-2022-33980 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: UI (Apache Commons Configuration) — CVE-2022-33980
Oracle Oracle Financial Services Applications Risk Matrix: UI (Apache Commons Configuration) vulnerability
CVE: CVE-2022-33980
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Apache Commons Configuration) — CVE-2022-33980
vendor_oracle·2023-04-15·CVSS 9.8
CVE-2022-33980 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Apache Commons Configuration) — CVE-2022-33980
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Apache Commons Configuration) vulnerability
CVE: CVE-2022-33980
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Cloud native deployment (Apache Commons Configuration) — CVE-2022-33980
vendor_oracle·2023-01-15·CVSS 9.8
CVE-2022-33980 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Cloud native deployment (Apache Commons Configuration) — CVE-2022-33980
Oracle Oracle Communications Applications Risk Matrix: Cloud native deployment (Apache Commons Configuration) vulnerability
CVE: CVE-2022-33980
CVSS: 9.8
Protocol: TCP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Jenkins
Jenkins Security Advisory 2022-11-15
vendor_jenkins·2022-11-15·CVSS 7.5
CVE-2022-33980 [HIGH] Jenkins Security Advisory 2022-11-15
Title: Jenkins Security Advisory 2022-11-15
Jenkins Security Advisory 2022-11-15
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Associated Files
Plugin
BART
Plugin
CCCC
Plugin
CloudBees Docker Hub/Registry Notification
Plugin
Cluster Statistics
Plugin
Config Rotator
Plugin
Delete log
Plugin
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: BI Application Archive (Apache Commons Configuration) — CVE-2022-33980
vendor_oracle·2022-10-15·CVSS 9.8
CVE-2022-33980 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: BI Application Archive (Apache Commons Configuration) — CVE-2022-33980
Oracle Oracle Fusion Middleware Risk Matrix: BI Application Archive (Apache Commons Configuration) vulnerability
CVE: CVE-2022-33980
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Red Hat
apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults
vendor_redhat·2022-07-06·CVSS 9.8
CVE-2022-33980 [CRITICAL] apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults
apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Appli
Debian
CVE-2022-33980: commons-configuration2 - Apache Commons Configuration performs variable interpolation, allowing propertie...
vendor_debian·2022·CVSS 9.8
CVE-2022-33980 [CRITICAL] CVE-2022-33980: commons-configuration2 - Apache Commons Configuration performs variable interpolation, allowing propertie...
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remot
No detection rules found.
No public exploits indexed.
arXiv
SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java
arxiv_fulltext·2024-06-28
SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java
: Countering Dynamic Code Injection based on Software Bill of Materials in Java
Aman Sharma,
Martin Wittlinger,
Benoit Baudry,
Martin Monperrus
A. Sharma and M. Monperrus are with the KTH Royal Institute of Technology, Stockholm, Sweden
Email: \amansha, monperrus\@kth.se
M. Wittlinger is with the HDI Group, Cologne, Germany
Email: [email protected]
B. Baudry is with the Universtit\'e de Montr\'eal, Montr\'eal, Canada
Email: [email protected]
## Abstract
Software supply chain attacks have become a significant threat as software development increasingly relies on contributions from multiple, often unverified sources.
The code from unverified sources does not pose a threat until it is executed.
Log4Shell is a recent example of a supply chain attack that processed a ma
Qualys
Oracle Patch Tuesday, October 2023 Security Update Review | Qualys
blogs_qualys·2023-10-18
Oracle Patch Tuesday, October 2023 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released its fourth quarterly edition of Critical Patch Update, which contains a group of patches for 387 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During the Q4 2023 Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of 103 patches, constituting 26% of the total patches released. Oracle Communications and Oracle Fusion Middleware fo
Qualys
Oracle Patch Tuesday, October 2023 Security Update Review
blogs_qualys·2023-10-18
Oracle Patch Tuesday, October 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released its fourth quarterly edition of Critical Patch Update, which contains a group of patches for 387 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During the Q4 2023 Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of 103 patches, constituting 26% of the total patches released. Oracle Communications and Oracle Fusion Middleware followed,
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followed, with
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followe
Qualys
Oracle Security Updates: Critical Patch April 2023 Advisory | Qualys
blogs_qualys·2023-04-19
Oracle Security Updates: Critical Patch April 2023 Advisory | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q2 2023 Oracle Critical Patch Update, the Oracle Communications product suite recorded the highest number of patches at 77, constituting 17% of the total patches released. The Oracle Financial Services Applications and Oracle Fusion Mi
Qualys
Oracle Patch Tuesday April 2023 Security Update Review
blogs_qualys·2023-04-19
Oracle Patch Tuesday April 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q2 2023 Oracle Critical Patch Update, the Oracle Communications product suite recorded the highest number of patches at 77, constituting 17% of the total patches released. The Oracle Financial Services Applications and Oracle Fusion Middlewar
http://www.openwall.com/lists/oss-security/2022/07/06/5http://www.openwall.com/lists/oss-security/2022/11/15/4https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87shttps://security.netapp.com/advisory/ntap-20221028-0015/https://www.debian.org/security/2022/dsa-5290http://www.openwall.com/lists/oss-security/2022/07/06/5http://www.openwall.com/lists/oss-security/2022/11/15/4https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87shttps://security.netapp.com/advisory/ntap-20221028-0015/https://www.debian.org/security/2022/dsa-5290
2022-07-06
Published