CVE-2022-42889
CriticalExploitedPublic exploitApache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
Published May 18, 2023 · Updated Oct 8, 2026 · Also known as Act4Shell, DEBIAN-CVE-2022-42889, GHSA-599f-7c49-w659, ROOT-APP-MAVEN-CVE-2022-42889, TR-23-0229, Text4Shell, UBUNTU-CVE-2022-42889
Key Facts
Patch immediately- CVE-2022-42889 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Commons Text (Apache), Security Threat Response Manager (Juniper), Bluexp (Netapp) and 22 more products.
- It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Oct 20, 2022. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- Fixed versions are available, including Commons Text 1.10.0, Commons Text Apache Commons Text*, Commons Text 1.10.0-1.1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
2 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-42889 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jan 12, 2023 | n/a | Not reported |
| CIRCL KEV | Oct 20, 2022 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
55 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Commons TextApache | See advisory | 1.10.0 |
| Security Threat Response ManagerJuniper | 7.5.0, 7.5.0-up1, 7.5.0-up2, 7.5.0-up3 | 7.5.0 |
| BluexpNetapp | See advisory | n/a |
| Jsa1500Juniper | See advisory | n/a |
| Jsa3500Juniper | See advisory | n/a |
Patched Releases
Commons Text
1.10.0, Apache Commons Text*, 1.10.0-1.1, 1.10.0-1
apache-commons-text-javadoc
1.10.0-1.1
candlepin
0:4.2.13-1.el8sat
eap7-apache-cxf
0:3.1.16-4.redhat_00003.1.ep7.el7
eap7-hal-console
0:3.2.17-1.Final_redhat_00001.1.el7eap
eap7-jackson-annotations
0:2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-core
0:2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-databind
0:2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-jaxrs-providers
0:2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base
0:2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-modules-java8
0:2.10.4-2.redhat_00004.1.el7eap
eap7-jettison
0:1.5.2-2.redhat_00002.1.el7eap
eap7-netty
0:4.1.63-1.Final_redhat_00002.1.ep7.el7
eap7-resteasy
0:3.0.27-1.Final_redhat_00001.1.ep7.el7
eap7-snakeyaml
0:1.33.0-1.SP1_redhat_00001.1.ep7.el7
eap7-velocity
0:1.7.0-3.redhat_00006.1.ep7.el7
eap7-wildfly
0:7.1.9-2.GA_redhat_00002.1.ep7.el7
io.root.org.apache.commons:commons-text
1.9-root.io.1
jenkins
2-plugins-0:4.14.1706516441-1.el8
Security Threat Response Manager
7.5.0
libsolv
0.7.20-6.el8+sp999
org.apache.commons:commons-text
1.10.0, 1.9-aikido.1
python-jinja2
2.7.2-4.el7+sp999
seal-libsolv
0.7.20-6.el8+sp999
seal-python-jinja2
2.7.2-4.el7+sp999
Timeline
Added to CIRCL KEV
Oct 20, 2022
Added to Industry KEV feed
Jan 12, 2023
Publicly disclosed
May 18, 2023
Last updated
Oct 8, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryhttp://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
- advisoryRHSA-2022:8652
- advisoryRHSA-2022:8876
- advisoryRHSA-2022:8902
- advisoryRHSA-2022:9023
FAQ
Common Questions.
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
Affected: Commons Text (Apache); Security Threat Response Manager (Juniper) versions 7.5.0, 7.5.0-up1, 7.5.0-up2, 7.5.0-up3; Bluexp (Netapp), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Oct 20, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Commons Text 1.10.0, Commons Text Apache Commons Text*, Commons Text 1.10.0-1.1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-42889 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo