Skip to content

Vendor

org.apache.commons vulnerabilities

27 published CVES affecting org.apache.commons, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
27
Critical
5
High
11
Medium
11
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.apache.commons alerts

Products

Latest org.apache.commons CVEs

Newest publication first · page 1 of 2

  12. CVE-2022-42889 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

    Published
    CriticalCVSS 9.8 EPSS 99.9% Framework module Public exploit PoC

    Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs...

  13. CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults

    Published
    CriticalCVSS 9.8 EPSS 44.6%

    Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup...

  18. CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO

    Published
    MediumCVSS 4.8 EPSS 10.5% PoC

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limite...

  19. CVE-2020-1953 Remote code execution in Apache Commons Configuration

    Published
    CriticalCVSS 10.0 EPSS 6.3%

    Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this libr...

  20. CVE-2019-12402 Denial of Service in Apache Commons Compress

    Published
    HighCVSS 7.5 EPSS 16.2% PoC

    The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Co...

  22. CVE-2018-1294 Improper Input Validation Apache Commons Email

    Published
    HighCVSS 7.5 EPSS 2.8%

    If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to C...

  24. CVE-2015-7501 Deserialization of Untrusted Data in Apache commons collections

    Published
    CriticalCVSS 9.8 EPSS 85.6% PoC

    Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SO...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.