QID 375721

Apache Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information.

Apache Maven will follow repositories that are defined in a dependency Project Object Model which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository.

Affected Versions:
All Apache Maven versions prior to v3.8.1

QID Detection Logic:(Authenticated)
The QID checks for vulnerable version of Apache Maven with "mvn -v" command.

Successful exploitation of the vulnerability can allow an attacker to execute following attacks:
Possible Man-In-The-Middle-Attack due to custom repositories using HTTP
Possible Domain Hijacking due to custom repositories using abandoned domains
Possible hijacking of downloads by redirecting to custom repositories