CVE-2022-33980

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.

• http://www.openwall.com/lists/oss-security/2022/07/06/5Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87sMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221028-0015/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5290Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/07/06/5Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87sMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221028-0015/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5290Third Party Advisory

Published

Jul 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33974Cross-Site Request Forgery (CSRF) vulnerability in Smash Bal…8.8
• CVE-2022-33976Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33977untangle is a python library to convert XML data to python o…7.5
• CVE-2022-33978Reflected Cross-Site Scripting (XSS) vulnerability FontMeist…6.1
• CVE-2022-33979Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-3398OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-o…9.8
• CVE-2022-33981drivers/block/floppy.c in the Linux kernel before 5.17.6 is …3.3
• CVE-2022-33982DMA attacks on the parameter buffer used by the Int15Service…6.4
• CVE-2022-33983DMA transactions which are targeted at input buffers used fo…7
• CVE-2022-33984DMA transactions which are targeted at input buffers used fo…7
• CVE-2022-33985DMA transactions which are targeted at input buffers used fo…7
• CVE-2022-33986DMA attacks on the parameter buffer used by the VariableRunt…6.4