CVE-2019-20343 - The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary command-line arguments in an arguments element)

Back Back to CVE browser

CRITICAL

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary command-line arguments in an arguments element)

Published Jan 6, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.41%

Description

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary command-line arguments in an arguments element).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (4)

https://drive.google.com/open?id=0B5UvrSwn4wuwTnNqSzZESjIwZHo5ZXhWdHh2T2Z0eWRCT1hF
x_refsource_MISCThird Party Advisory
https://drive.google.com/open?id=1GLs0d9IGArMVrlbEGbxgCjA1MuzIJk-3
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10896
Advisory
https://www.mojohaus.org/exec-maven-plugin/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://drive.google.com/open?id=0B5UvrSwn4wuwTnNqSzZESjIwZHo5ZXhWdHh2T2Z0eWRCT1hF		x_refsource_MISCThird Party Advisory
https://drive.google.com/open?id=1GLs0d9IGArMVrlbEGbxgCjA1MuzIJk-3		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10896		Advisory
https://www.mojohaus.org/exec-maven-plugin/		x_refsource_MISCVendor Advisory