Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/53773?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53773?format=api", "vulnerability_id": "VCID-mbst-3bec-ykcq", "summary": "Code injection in Apache Commons Configuration\nApache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.", "aliases": [ { "alias": "CVE-2022-33980" }, { "alias": "GHSA-xj57-8qj4-c4m6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/584071?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.8.0-1~deb11u1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.8.0-1~deb11u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/584266?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.8.0-1~deb11u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.8.0-1~deb11u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/585036?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.8.0-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.8.0-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/584267?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.8.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.8.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/584268?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.11.0-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.11.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/584269?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.11.0-3?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.11.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/81321?format=api", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-configuration2@2.8.0" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1057599?format=api", "purl": "pkg:deb/debian/commons-configuration2@2.2-1%2Bdeb10u1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cy9f-u66u-6ben" }, { "vulnerability": "VCID-mbst-3bec-ykcq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/commons-configuration2@2.2-1%252Bdeb10u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/144186?format=api", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-cy9f-u66u-6ben" }, { "vulnerability": "VCID-mbst-3bec-ykcq" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-configuration2@2.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/201736?format=api", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-cy9f-u66u-6ben" }, { "vulnerability": "VCID-mbst-3bec-ykcq" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-configuration2@2.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/201737?format=api", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-cy9f-u66u-6ben" }, { "vulnerability": "VCID-mbst-3bec-ykcq" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-configuration2@2.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/73645?format=api", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7dw4-pssj-dqf8" }, { "vulnerability": "VCID-mbst-3bec-ykcq" }, { "vulnerability": "VCID-y9pv-wgb6-mfa7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.commons/commons-configuration2@2.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/96695?format=api", "purl": "pkg:rpm/redhat/candlepin@4.2.13-1?arch=el8sat", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2cup-9gdn-yyhk" }, { "vulnerability": "VCID-4nu3-fknt-puej" }, { "vulnerability": "VCID-6354-p39b-zbhp" }, { "vulnerability": "VCID-9h46-72hw-bkcr" }, { "vulnerability": "VCID-dmkc-42vj-gbhc" }, { "vulnerability": "VCID-fb8u-g65k-hffs" }, { "vulnerability": "VCID-j986-mtma-b3bw" }, { "vulnerability": "VCID-mbst-3bec-ykcq" }, { "vulnerability": "VCID-mm3e-4pej-byed" }, { "vulnerability": "VCID-qub7-qp14-uqcg" }, { "vulnerability": "VCID-qxfs-sq38-jfad" }, { "vulnerability": "VCID-v2pq-1qhm-4qb9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/candlepin@4.2.13-1%3Farch=el8sat" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-33980.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-33980.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-33980", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99423", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99419", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99424", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99422", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99421", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.9942", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99414", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99417", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.86659", "scoring_system": "epss", "scoring_elements": "0.99418", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-33980" }, { "reference_url": "https://commons.apache.org/proper/commons-configuration/changes-report.html#a2.8.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://commons.apache.org/proper/commons-configuration/changes-report.html#a2.8.0" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33980", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33980" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/commons-configuration", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/commons-configuration" }, { "reference_url": "https://issues.apache.org/jira/browse/CONFIGURATION-753", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/CONFIGURATION-753" }, { "reference_url": "https://issues.apache.org/jira/browse/CONFIGURATION-764", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/CONFIGURATION-764" }, { "reference_url": "https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33980", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33980" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221028-0015", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20221028-0015" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221028-0015/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20221028-0015/" }, { "reference_url": "https://www.debian.org/security/2022/dsa-5290", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2022/dsa-5290" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/07/06/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/07/06/5" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/11/15/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2022/11/15/4" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014960", "reference_id": "1014960", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014960" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105067", "reference_id": "2105067", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105067" }, { "reference_url": "https://github.com/advisories/GHSA-xj57-8qj4-c4m6", "reference_id": "GHSA-xj57-8qj4-c4m6", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xj57-8qj4-c4m6" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6916", "reference_id": "RHSA-2022:6916", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6916" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8652", "reference_id": "RHSA-2022:8652", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8652" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2097", "reference_id": "RHSA-2023:2097", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2097" } ], "weaknesses": [ { "cwe_id": 74, "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "description": "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "7.5 - 10.0", "exploitability": "2.0", "weighted_severity": "9.0", "risk_score": 10.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mbst-3bec-ykcq" }