CVE-2024-47197

Summary

CVE-2024-47197 is a vulnerability affecting the Maven Archetype Plugin from versions 3.2.1 to 3.3.0. This issue results in the exposure of sensitive information, including credentials, to unauthorized actors. During archetype integration testing, a file named "./target/classes/archetype-it/archetype-settings.xml" is created, which contains all the content from the user's ~/.m2/settings.xml file. If a developer runs "mvn verify" without a "mvn clean," this file becomes part of the final artifact. Inadvertent publication of these artifacts with sensitive information can lead to unintended credential disclosure. Users are advised to upgrade to version 3.3.0 to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.