Arbitrary Code Execution Affecting org.apache.commons:commons-configuration2 package, versions [2.4,2.8)



    Attack Complexity High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 61.23% (98th percentile)
Expand this section
9.8 critical
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 8 Jul 2022
  • disclosed 7 Jul 2022
  • credit Unknown

How to fix?

Upgrade org.apache.commons:commons-configuration2 to version 2.8 or higher.


org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the Lookup functionality due to the ability to use certain insecure lookups that perform interpolation.

These lookups are:

  1. script execute expressions using the JVM script execution engine (javax.script).

  2. dns resolve DNS records.

  3. url load values from URLs, including from remote servers.

CVSS Score Explanation:

This module is designed for secure configuration management. This implies that the files it handles should have limited access, whether local or remote. Remote attacks require basic privileges and server setup for remote commands. This aligns with AC:H and PR:L