VDB
BDU%3A2023-05216
BDU%3A2023-05216
PUBLISHED
CVSS 9.399999618530273 CRITICAL
Уязвимость фреймворка Apache Maven, позволяющая нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации
Risk Scores
CVSS 2.0
9.399999618530273
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Maven | Apache Maven |
| Oracle Corp., ООО «Ред Софт», OpenSearch, Apache Software Foundation, Elastic NV, Google Inc | Financial Services Analytical Applications Infrastructure, РЕД ОС (запись в едином реестре российских программ №3751), GoldenGate Big Data and Application Adapters, Logstash, Maven, Android Studio |
Timeline
- Apr 7, 2022 PoC Published
- Sep 6, 2023 CVE Published
- Oct 21, 2023 PoC Published
- Nov 17, 2024 PoC Published
- Feb 10, 2026 CVE Updated
- Apr 13, 2026 PoC Published
References
- https://lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc@%3Cissues.karaf.apache.org%3E url
- https://lists.apache.org/thread.html/r5ae6aaa8a2ce86145225c3516bb45d315c0454e3765d651527e5df8a@%3Ccommits.kafka.apache.org%3E url
- https://www.whitesourcesoftware.com/resources/blog/maven-security-vulnerability-cve-2021-26291/ url
- https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E url
- [maven-dev] 20210423 CVE-2021-26291: Apache Maven: block repositories using http by default mailing-list
- [announce] 20210423 CVE-2021-26291: Apache Maven: block repositories using http by default mailing-list
- [myfaces-dev] 20210506 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #817: build: CVE fix mailing-list
- [kafka-jira] 20210520 [jira] [Assigned] (KAFKA-12820) Upgrade maven-artifact dependency to resolve CVE-2021-26291 mailing-list
- [kafka-commits] 20210521 [kafka] branch 2.6 updated: KAFKA-12820: Upgrade maven-artifact dependency to resolve CVE-2021-26291 mailing-list
- [kafka-commits] 20210521 [kafka] branch 2.8 updated: KAFKA-12820: Upgrade maven-artifact dependency to resolve CVE-2021-26291 mailing-list
- [kafka-jira] 20210521 [jira] [Resolved] (KAFKA-12820) Upgrade maven-artifact dependency to resolve CVE-2021-26291 mailing-list
- [karaf-issues] 20210718 [jira] [Created] (KARAF-7224) Impact of CVE-2021-26291 on Karaf mailing-list
- [karaf-issues] 20210718 [jira] [Created] (KARAF-7223) Upgrade maven artifacts to mitigate CVE-2021-26291 mailing-list
- [karaf-issues] 20210719 [jira] [Commented] (KARAF-7224) Impact of CVE-2021-26291 on Karaf mailing-list
- [karaf-issues] 20210719 [jira] [Assigned] (KARAF-7224) Impact of CVE-2021-26291 on Karaf mailing-list
- [oss-security] 20210423 CVE-2021-26291: Apache Maven: block repositories using http by default mailing-list
- [karaf-issues] 20210720 [jira] [Commented] (KARAF-7224) Impact of CVE-2021-26291 on Karaf mailing-list
- [kafka-jira] 20210809 [jira] [Commented] (KAFKA-12820) Upgrade maven-artifact dependency to resolve CVE-2021-26291 mailing-list
- [druid-commits] 20210809 [GitHub] [druid] abhishekagarwal87 merged pull request #11562: suppress CVE-2021-26291 on kafka-clients mailing-list
- [karaf-issues] 20210810 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list
…and 27 more