CVE-2022-42889

Description

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2022-42889 on 2026-07-27. Shown when MITRE's text differs from the cvelistV5 mirror.

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2025-04-17 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/dell-powerstore-dsa2025182-cve-2022-42889/

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2022-10-13 13:15:10 UTC

NVD last modified

2026-06-17 05:05:31 UTC

NVD CVSS v3.1

9.8 / 10 CRITICAL source: nvd@nist.gov

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

3.9 / 10

Impact subscore

5.9 / 10

EPSS score

0.9993 (probability of exploitation in next 30 days)

EPSS percentile

99.97% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-94 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-7022

Assigner

apache

Published

Oct 13, 2022, 12:00:00 AM

Updated

Nov 20, 2024, 4:19:41 PM

EUVD-reported EPSS

99.9300

Vendors

Apache Software Foundation

Products

Apache Commons Text (1.5 <Apache Commons Text*)

Apache Commons Text (unspecified ≤1.9)

Aliases

GHSA-599f-7c49-w659

ENISA description: Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

MITRE references (7) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
• GLSA-202301-05 vendor-advisory
• https://security.netapp.com/advisory/ntap-20221020-0004/
• 20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory mailing-list
• [oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults mailing-list
• http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
• http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html

Web references (8)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://errata.rockylinux.org/RLSA-2023:2097 rapid7:errata.rockylinux.org
• http://www.openwall.com/lists/oss-security/2022/10/13/4 rapid7:www.openwall.com
• https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om rapid7:lists.apache.org
• https://www.dell.com/support/kbdoc/en-us/000308870/dsa-2025-182-dell-powerstore-x-security-update-for-multiple-vulnerabilities rapid7:www.dell.com
• https://attackerkb.com/topics/CVE-2022-42889 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7022 rapid7:euvd.enisa.europa.eu
• https://www.cve.org/CVERecord?id=CVE-2022-42889 rapid7:www.cve.org
• http://cwe.mitre.org/data/definitions/94.html rapid7:cwe.mitre.org

• Rapid7 — Solution
  rapid7

  linuxrpm-upgrade-jenkins-2-plugins

  2026-05-28 23:51 UTC

Only Available for Registered Users. Sign in to view.