CVE Daily – Apache Maven https://cvedaily.com/pages/tags/apache-maven.html CVE Daily – Apache Maven en Wed, 03 Jun 2026 21:27:09 +0000 [High] CVE-2022-46751 – Improper Restriction of XML External Entity Reference, XML Injection (aka Blind ... https://nvd.nist.gov/vuln/detail/CVE-2022-46751 https://nvd.nist.gov/vuln/detail/CVE-2022-46751 Mon, 21 Aug 2023 07:15:33 +0000 High CVE-2022-46751

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand…

CVSS: 8.2 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2022-29599 – In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class... https://nvd.nist.gov/vuln/detail/CVE-2022-29599 https://nvd.nist.gov/vuln/detail/CVE-2022-29599 Mon, 23 May 2022 11:16:10 +0000 Critical CVE-2022-29599

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

CVSS: 9.8 · CWE: CWE-116

View on NVD

]]> [Critical] CVE-2021-26291 – Apache Maven will follow repositories that are defined in a dependency’s Project... https://nvd.nist.gov/vuln/detail/CVE-2021-26291 https://nvd.nist.gov/vuln/detail/CVE-2021-26291 Fri, 23 Apr 2021 15:15:09 +0000 Critical CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository referen…

CVSS: 9.1 · CWE: CWE-346

View on NVD

]]> [High] CVE-2018-11804 – Spark's Apache Maven-based build includes a convenience script, 'build/mvn', tha... https://nvd.nist.gov/vuln/detail/CVE-2018-11804 https://nvd.nist.gov/vuln/detail/CVE-2018-11804 Wed, 24 Oct 2018 18:29:00 +0000 High CVE-2018-11804

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the…

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Medium] CVE-2013-0253 – The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, dis... https://nvd.nist.gov/vuln/detail/CVE-2013-0253 https://nvd.nist.gov/vuln/detail/CVE-2013-0253 Tue, 09 Apr 2013 20:55:01 +0000 Medium CVE-2013-0253

The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.

CVSS: 5.8 · CWE: CWE-16

View on NVD

]]>