Forgot password?


Apache Commons Text Vulnerability

Threat Intelligence from DigitalXRAID’s Security Operations Centre analysts:

The Apache Commons Text library has been found to contain a vulnerability which can result in code execution. Originally reported by Alvaro Munoz, this vulnerability comes from an insecure implementation of Commons Text’s variable interpolation functionality.

Read more about the CVE detail here: CVE-2022-42889
The CVSS (Common Vulnerability Scoring System) Severity Score has been rated as: 9.8 (critical)

Common Text is a java source code library, used as a general purpose text manipulation toolkit. This vulnerability resides in the StringSubstitutor interpolator object. The interpolator will allow string lookups, which can be used by passing a string “${prefix:name}”, where the prefix is the lookup defined in the StringLookupFactory.

By using lookups such as “script”, “dns” or “url”, a crafted string would be able to execute arbitrary scripts when it has been passed to the interpolator object.

This affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10.

The recommended action is to upgrade to version 1.10 as soon as possible if there is a direct dependency on Commons Text. In common with other vulnerabilities, the likelihood is that vendors will release advisories in the near future with upgrades to any of their products which utilise the library.

If you discover that you’ve suffered a breach as a result of this or any other vulnerability, and need help urgently, get in contact with us. You can call our emergency line on 0800 066 4509 to speak to one of our experts. They’re available 24 hours a day, 7 days a week. Bookmark this page in case you ever need us.   

If you need any support in mitigating any risks this vulnerability may have on your business, please don’t hesitate to get in contact

Cyber Security Experts

Accredited and regulated, we're in the top 1% of cyber security agencies globally

Crown Commercial Service Supplier Cyber Essentials Plus ISO 27001 BSI ISO 9001 CHECK NCSC Cyber Incident Response CREST

We’re trusted by the UK Government as Crown Commercial Service providers as well as being accredited by two of the leading cyber security governing bodies. Our ISO9001 certification means you can rest assured our processes and approach are market leading.

Protect Your Business & Your Reputation.

With a continued focus on security, you can rest assured that breaches and exploits won't be holding you back.

Speak To An Expert


Get In Touch

[contact-form-7 id="5" title="Contact Us Form"]