CVE-2017-1000487

OS Command Injection in Plexus-utils

9.8 CriticalPublic exploitFix available

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.49%Up 4.0 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: CVE-2017-1000487
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: CVE-2017-1000487
Updated: 2026-11-02

EUVDEUVD-2022-3243 No score

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: EUVD-2022-3243
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8vhq-qq4p-grq3 9.8

OS Command Injection in Plexus-utils

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: GHSA-8vhq-qq4p-grq3
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.8

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: CVE-2017-1000487
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-1000487 9.8

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: DEBIAN-CVE-2017-1000487
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 17 moreShow less

OSVGHSA-8vhq-qq4p-grq3 9.8

OS Command Injection in Plexus-utils

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: GHSA-8vhq-qq4p-grq3
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000487 9.8

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Record: UBUNTU-CVE-2017-1000487
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2024-1733961633 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (3 CVEs)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 3 CVEs. Fixed in 1.5.8.tuxcare.

Record: CLSA-2024-1733961633
Updated: 2026-11-02

OSVCLSA-2026-1794234477 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.15-tuxcare.3.

Record: CLSA-2026-1794234477
Updated: 2026-11-09

OSVCLSA-2026-1794235951 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 2.0.6-tuxcare.3.

Record: CLSA-2026-1794235951
Updated: 2026-11-09

OSVCLSA-2026-1794236115 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 2.1-tuxcare.3.

Record: CLSA-2026-1794236115
Updated: 2026-11-09

OSVCLSA-2026-1794236288 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.1-tuxcare.3.

Record: CLSA-2026-1794236288
Updated: 2026-11-09

OSVCLSA-2026-1794236532 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.8-tuxcare.2.

Record: CLSA-2026-1794236532
Updated: 2026-11-09

OSVCLSA-2026-1794237003 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 2.0.5-tuxcare.3.

Record: CLSA-2026-1794237003
Updated: 2026-11-09

OSVCLSA-2026-1794237242 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.1-tuxcare.2.

Record: CLSA-2026-1794237242
Updated: 2026-11-09

OSVCLSA-2026-1794237368 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.5.6-tuxcare.3.

Record: CLSA-2026-1794237368
Updated: 2026-11-09

OSVCLSA-2026-1794237845 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.4.5-tuxcare.3.

Record: CLSA-2026-1794237845
Updated: 2026-11-09

OSVCLSA-2026-1794238062 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.5.15-tuxcare.3.

Record: CLSA-2026-1794238062
Updated: 2026-11-09

OSVCLSA-2026-1794238191 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.5.5-tuxcare.2.

Record: CLSA-2026-1794238191
Updated: 2026-11-09

OSVCLSA-2026-1794238288 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 2.0.4-tuxcare.3.

Record: CLSA-2026-1794238288
Updated: 2026-11-09

OSVCLSA-2026-1794238651 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (3 CVEs)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 3 CVEs. Fixed in 2.0.7-tuxcare.1.

Record: CLSA-2026-1794238651
Updated: 2026-11-09

OSVCLSA-2026-1794240416 No score

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.2-tuxcare.2.

Record: CLSA-2026-1794240416
Updated: 2026-11-09

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.codehaus.plexus:plexus-utils` Maven	before 3.0.16	3.0.16
`org.codehaus.plexus:plexus-utils` TuxCare:Maven From an advisory covering 3 CVEs	1.5.8 up to 1.5.8.tuxcare	1.5.8.tuxcare
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	3.0.15 up to 3.0.15-tuxcare.3, plus listed versions 3.0.15-tuxcare.13.0.15-tuxcare.2	3.0.15-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	2.0.6 up to 2.0.6-tuxcare.3, plus listed versions 2.0.6-tuxcare.12.0.6-tuxcare.2	2.0.6-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	2.1 up to 2.1-tuxcare.3, plus listed versions 2.1-tuxcare.12.1-tuxcare.2	2.1-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	3.0.1 up to 3.0.1-tuxcare.3, plus listed versions 3.0.1-tuxcare.13.0.1-tuxcare.2	3.0.1-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	3.0.8 up to 3.0.8-tuxcare.2, plus listed versions 3.0.8-tuxcare.1	3.0.8-tuxcare.2
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	2.0.5 up to 2.0.5-tuxcare.3, plus listed versions 2.0.5-tuxcare.12.0.5-tuxcare.2	2.0.5-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.1 up to 1.1-tuxcare.2, plus listed versions 1.1-tuxcare.1	1.1-tuxcare.2
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.5.6 up to 1.5.6-tuxcare.3, plus listed versions 1.5.6-tuxcare.11.5.6-tuxcare.2	1.5.6-tuxcare.3

Show 18 moreShow less

Affected packages
Package	Affected	Fixed
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.4.5 up to 1.4.5-tuxcare.3, plus listed versions 1.4.5-tuxcare.11.4.5-tuxcare.2	1.4.5-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.5.15 up to 1.5.15-tuxcare.3, plus listed versions 1.5.15-tuxcare.11.5.15-tuxcare.2	1.5.15-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.5.5 up to 1.5.5-tuxcare.2, plus listed versions 1.5.5-tuxcare.1	1.5.5-tuxcare.2
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	2.0.4 up to 2.0.4-tuxcare.3, plus listed versions 2.0.4-tuxcare.12.0.4-tuxcare.2	2.0.4-tuxcare.3
`org.codehaus.plexus:plexus-utils` TuxCare:Maven From an advisory covering 3 CVEs	2.0.7 up to 2.0.7-tuxcare.1	2.0.7-tuxcare.1
`org.codehaus.plexus:plexus-utils` TuxCare:Maven	1.2 up to 1.2-tuxcare.2, plus listed versions 1.2-tuxcare.1	1.2-tuxcare.2
`plexus-utils2` Debian:12	before 3.0.22-1	3.0.22-1
`plexus-utils2` Debian:13	before 3.0.22-1	3.0.22-1
`plexus-utils2` Debian:14	before 3.0.22-1	3.0.22-1
`plexus-utils` Debian:7	before 1:1.5.15-4+deb7u1, plus listed versions 1:1.5.15-4	1:1.5.15-4+deb7u1
`plexus-utils2` Debian:7	before 2.0.5-1+deb7u1, plus listed versions 2.0.5-1	2.0.5-1+deb7u1
`plexus-utils` Debian:8	before 1:1.5.15-4+deb8u1, plus listed versions 1:1.5.15-4	1:1.5.15-4+deb8u1
`plexus-utils` Debian:9	before 1:1.5.15-4+deb9u1, plus listed versions 1:1.5.15-4	1:1.5.15-4+deb9u1
`plexus-utils2` Debian:8	before 3.0.15-1+deb8u1, plus listed versions 3.0.15-1	3.0.15-1+deb8u1
`org.codehaus.plexus:plexus-utils` Maven	before 3.0.16, plus listed versions 1.0.41.0.51.11.21.3 Show 45 moreShow less 1.41.4-alpha-11.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.51.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.92.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.13.03.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.2	3.0.16
`plexus-utils` Ubuntu:14.04:LTS	before 1:1.5.15-4+deb8u1build0.14.04.1, plus listed versions 1:1.5.15-4	1:1.5.15-4+deb8u1build0.14.04.1
`plexus-utils2` Ubuntu:14.04:LTS	before 2.0.5-1+deb7u1build0.14.04.1, plus listed versions 2.0.5-1	2.0.5-1+deb7u1build0.14.04.1
`plexus-utils` Ubuntu:16.04:LTS	before 1:1.5.15-4+deb8u1build0.16.04.1, plus listed versions 1:1.5.15-4	1:1.5.15-4+deb8u1build0.16.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	shoucheng3/codehaus-plexus__plexus-utils_CVE-2017-1000487_3-0-15	2025-08-19

History

History
Recorded	Changed	Sources
Nov 9, 2026	affected, aliases	OSV
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000487 is a critical vulnerability (CVSS 9.8) in Codehaus-plexus Plexus-utils, published January 3, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.49%, the 93rd percentile. Fixed in org.codehaus.plexus:plexus-utils 3.0.16.

References

Show 15 moreShow less

This page doesn't list everything

Left out here: 7 versions. The JSON record has them.