PT-2024-32476 · Apache · Maven Archetype Plugin

Niels Basjes · Published 2024-09-26 · Updated 2025-03-17 · CVE-2024-47197

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Maven Archetype Plugin versions 3.2.1 through 3.2.x Maven Archetype Plugin versions prior to 3.3.0

Description The issue is related to the exposure of sensitive information to unauthorized actors due to insecure storage of sensitive information in the Maven Archetype Plugin. This occurs when archetype integration testing creates a file called ./target/classes/archetype-it/archetype-settings.xml, which contains all the content from the user's ~/.m2/settings.xml file, often including credentials. If a developer publishes this file into Maven Central or any other remote repository without knowing, their credentials would be published.

Recommendations For Maven Archetype Plugin versions 3.2.1 through 3.2.x, upgrade to version 3.3.0, which fixes the issue. For Maven Archetype Plugin versions prior to 3.3.0, upgrade to version 3.3.0, which fixes the issue. As a temporary workaround, consider running mvn clean before mvn verify to avoid including the sensitive file in the final artifact.

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2024-47197

GHSA-2QQ7-FCH2-PHQF

OPENSUSE-SU-2024:14372-1

Affected Products

Maven Archetype Plugin

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2024-47197 · Security Note
• https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2qq7-fch2-phqf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14372-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47197 · Vendor Advisory
• https://github.com/apache/maven-archetype/pull/188 · Note
• https://github.com/apache/maven-archetype/commit/484b6ab946f0d7ce557a3df28615d8c51e500054 · Note
• https://github.com/apache/maven-archetype · Note
• http://openwall.com/lists/oss-security/2024/09/26/2 · Note
• https://issues.apache.org/jira/browse/ARCHETYPE-657 · Note
• https://twitter.com/oss_security/status/1839262382071198173 · Twitter Post
• https://t.me/cvenotify/96838 · Telegram Post
• https://t.me/cvenotify/115071 · Telegram Post
• https://twitter.com/GlobalFadi/status/1842577662075867484 · Twitter Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/F5AIDOTX2VOI34RL4X3LUJRIOBWTRLGU · Note