9.8

CVE-2017-1000487: codehaus-plexus plexus-utils OS Command Injection

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2017-1000487DEBIAN-CVE-2017-1000487DLA-1236-1
Published 03-01-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-1000487 is a critical (CVSS 9.8) OS Command Injection vulnerability in codehaus-plexus plexus-utils. EPSS estimates a 6.49% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
6.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 03-01-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

6.49%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.49% on 20-09-2026

20-09-202620-10-2026
EPSS score
6.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard51 products
  • eco-java-gradle-1.11All versions (No fix recorded)
  • eco-java-gradle-2.0All versions (No fix recorded)
  • eco-java-gradle-2.1All versions (No fix recorded)
  • eco-java-gradle-2.10All versions (No fix recorded)
  • eco-java-gradle-2.11All versions (No fix recorded)
Debian3 products
  • plexus-utils< 1:1.5.15-4+deb8u1 | < 1:1.5.15-4+deb9u1 | < 1:1.5.15-4+deb7u1
  • plexus-utils2< 3.0.22-1 | < 3.0.15-1+deb8u1 | < 2.0.5-1+deb7u1
  • debian_linuxEOL7.0 | 8.0 | 9.0
Ubuntu2 products
  • plexus-utils< 1:1.5.15-4+deb8u1build0.14.04.1 | < 1:1.5.15-4+deb8u1build0.16.04.1
  • plexus-utils2< 2.0.5-1+deb7u1build0.14.04.1
Codehaus-plexus1 product
Org.codehaus.plexus1 product
  • plexus-utils< 3.0.16

5 vendors · 58 products

References

20 links
Show all 20 references