Remote Code Execution (RCE) Affecting org.apache.commons:commons-configuration2 package, versions [2.2, 2.7)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
15 Mar 2020
13 Mar 2020
How to fix?
org.apache.commons:commons-configuration2 to version 2.7 or higher.
org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). It uses a third-party library to parse YAML files (
org.yaml:snakeyaml) which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration did not change the default settings of this library. Therefore if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.