GCVE - cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Codehaus Plexus (`9723b8eb-a4a9-51e7-a625-b91f32a19f36`)
Product	Plexus Utils (`a7003019-ea19-58dc-a2d0-bc5498e4d5e8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-67030`	vulnerable	2026-06-08 07:41:19.634275	Details available Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code Published: 2026-03-25T00:00:00.000Z Updated: 2026-09-14T12:04:29.342Z Open on db.gcve.eu Reference links https://github.com/codehaus-plexus/plexus-utils/pull/295 https://github.com/codehaus-plexus/plexus-utils/issues/294 https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642 https://github.com/codehaus-plexus/plexus-utils/pull/296 https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4245`	vulnerable	2026-06-08 05:51:37.039590	Codehaus-plexus: xml external entity (xxe) injection MEDIUM (4.3) A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection. Published: 2023-09-25T19:20:57.329Z Updated: 2024-08-03T01:34:49.896Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2023:2135 https://access.redhat.com/errata/RHSA-2023:3906 https://access.redhat.com/security/cve/CVE-2022-4245 https://bugzilla.redhat.com/show_bug.cgi?id=2149843	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4244`	vulnerable	2026-06-08 05:51:37.037734	Codehaus-plexus: directory traversal HIGH (7.5) A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files. Published: 2023-09-25T19:20:04.703Z Updated: 2024-08-03T01:34:49.883Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2023:2135 https://access.redhat.com/errata/RHSA-2023:3906 https://access.redhat.com/security/cve/CVE-2022-4244 https://bugzilla.redhat.com/show_bug.cgi?id=2149841	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000487`	vulnerable	2026-06-08 05:08:34.669270	Details available Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. Published: 2018-01-03T20:00:00.000Z Updated: 2024-08-05T22:00:41.635Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2018:1322 https://lists.debian.org/debian-lts-announce/2018/01/msg00011.html https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522 https://www.debian.org/security/2018/dsa-4149 https://www.debian.org/security/2018/dsa-4146	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.