What is the CVSS score of CVE-2021-26291?

CVE-2021-26291 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 8.7%.

Is there a public PoC exploit available for CVE-2021-26291?

Yes, a public proof-of-concept exploit is available for CVE-2021-26291. Prioritise patching immediately. EPSS: 8.7%.

Is there a patch available for CVE-2021-26291?

Yes, a patch is available for CVE-2021-26291. Update the affected software to the latest version immediately.

Maven CVE-2021-26291

CRITICAL

Origin Validation Error (CWE-346)

2021-04-23 security@apache.org

Apache Information Disclosure Maven Quarkus Financial Services Analytical Applications Infrastructure Goldengate Big Data And Application Adapters

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Apr 23, 2021 - 15:15 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

93 maven packages depend on org.apache.maven:maven-compat (45 direct, 48 indirect)
1,373 maven packages depend on org.apache.maven:maven-core (372 direct, 1,003 indirect)

Ecosystem-wide dependent count for version 3.8.1 and other introduced versions.

DescriptionNVD

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

AnalysisAI

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-346. Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html Affected products include: Apache Maven, Quarkus, Oracle Financial Services Analytical Applications Infrastructure, Oracle Goldengate Big Data And Application Adapters.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.