-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.streampark:streampark | maven | >= 2.0.0, < 2.1.2 | 2.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of Maven compilation parameters in the project module. The example shows attackers can inject commands using shell operators, indicating the system constructs OS commands by concatenating user input without proper validation(). The ProjectService class would logically contain the Maven integration logic, and a buildProject method would be responsible for executing compilation commands. The high confidence comes from: 1) The CWE-77 classification 2) Explicit mention of Maven parameter handling 3) Attack pattern requiring command string manipulation 4) Typical Java service class naming conventions in Apache projects.