CVE-2022-42889 Apache Commons Text
| Affected software | Apache Commons Text |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 |
| Fixed in | 1.10.0 |
| Weakness | Code injection (CWE-94) |
| Published | 13 Oct 2022 |
| Updated | 13 Nov 2026 |
Description
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · 41 exploits · earliest 2023-01-12.
- CISA Vulnrichment exploitation: none
- Indexed PoC 44 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2022-10-17.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-42889 in VulnCheck (free account), which lists 36 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | web.archive.org | /web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022 | 2023-01-12 |
| Reported exploitation | go.catonetworks.com | /rs/245-RJK-441/images/CATO-NETWORKS-THREAT-REPORT2024.pdf | 2024-05-07 |
| Reported exploitation | app.crowdsec.net | /cti/cve-explorer/CVE-2022-42889 | 2025-06-07 |
| Reported exploitation | linkedin.com | /pulse/nervous-burlywood-becard-campaign-leverages-log4j-other-exploits-zxqwf | 2025-09-29 |
| Exploit reference | VulnCheck XDB 94c887a105d9 | Exploit type: initial-access | 2022-10-17 |
| Exploit reference | VulnCheck XDB 5c158c054bc7 | Exploit type: initial-access | 2022-10-18 |
| Exploit reference | VulnCheck XDB 7129115e6e84 | Exploit type: initial-access | 2022-10-18 |
| Exploit reference | VulnCheck XDB 26c17d1f2e03 | Exploit type: initial-access | 2022-10-19 |
| Exploit reference | VulnCheck XDB b0bb4241ccd2 | Exploit type: initial-access | 2022-10-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Dockerized POC for CVE-2022-42889 Text4Shell | 76 | 2022-10-18 |
| Nuclei | Text4Shell - Remote Code Execution | ||
| Exploit-DB | Apache Commons Text 1.10.0 - Remote Code Execution | 2025-04-18 | |
| Metasploit | Apache Commons Text RCE (excellent rank) | ||
| GitHub PoC | Apache commons text - CVE-2022-42889 Text4Shell proof of concept exploit. | 57 | 2022-10-19 |
| GitHub PoC | cve-2022-42889 Text4Shell CVE-2022-42889 affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10. | 40 | 2022-10-18 |
| GitHub PoC | Proof of Concept for the Apache commons-text vulnerability CVE-2022-42889. | 35 | 2022-10-17 |
| GitHub PoC | text4shell(CVE-2022-42889) BurpSuite Scanner | 20 | 2022-12-09 |
| GitHub PoC | CVE-2022-42889 aka Text4Shell research & PoC | 20 | 2022-10-23 |
| GitHub PoC | Proof of Concept for CVE-2022-42889 (Text4Shell Vulnerability) | 15 | 2022-11-04 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2022-42889.armr patch rule, ARMR 2.6 added 2022-10-18 updated 2026-03-04Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Marshal RCE rule
How to mitigate CVE-2022-42889
Upgrade Apache Commons Text to 1.10.0 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle HealthCare Applications / FHIR (Apache Commons Text) (8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.3.0, 8.1.3.2, 8.1.3.4) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Analytics / BI Application Archive (Apache Commons Text) (6.4.0.0.0) Oracle Financial Services Applications / Application (Apache Commons Text) (8.1.2.4) Oracle HealthCare Applications / Self Service Analytics (Apache Commons Text) (5.0.0-5.0.4) Oracle HealthCare Applications / Self Service Analytics (Apache Commons Text) (8.1.0, 8.1.1, 8.2.0, 8.2.1, 8.2.2) Oracle Retail Applications / DB, Perf, etc (Apache Commons Text) (18.0.5, 19.0.4, 20.0.3, 21.0.2) Oracle Retail Applications / Point of Sale (Apache Commons Text) (18.0.5, 19.0.4, 20.0.3, 21.0.2) Oracle Retail Applications / Security (Apache Commons Text) (16.0.2, 16.0.3) Oracle Retail Applications / Xenvironment (Apache Commons Text) (18.0.5, 19.0.4, 20.0.3, 21.0.2) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Communications / Security (Apache Commons Text) (22.1.0.0.0) Oracle Communications / Signaling (Apache Commons Text) (22.3.4, 22.2.3) Oracle Communications / Virtual Network Function Manager (Apache Common Text) (8.6.0.0) Oracle Communications Applications / Core (Apache Commons Text) (5.5.0-5.5.9, 6.0.0-6.0.1) Oracle Communications Applications / Installer (Apache Commons Text) (7.4.0) Oracle Communications Applications / PSR Designer (Apache Commons Text) (7.4.2) Oracle Communications Applications / Security (Apache Commons Text) (12.0.0.3.0-12.0.0.7.0) Oracle Construction and Engineering / Admin (Apache Commons Text) (18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8) Oracle Enterprise Manager / Management Agent (Apache Commons Text) (13.4.0.0, 13.5.0.0) Oracle Fusion Middleware / Analytics Server (Apache Commons Text) (5.9.0.0.0, 6.4.0.0.0) Oracle Fusion Middleware / Content Server (Apache Commons Text) (12.2.1.4.0) Oracle Fusion Middleware / Third Party Patch (Apache Commons Text) (12.2.1.4.0) Oracle Hyperion / Installation and Configuration (Apache Commons Text) (11.2.10) Oracle JD Edwards / E1 IOT Orchestrator Security (Apache Commons Text) (Prior to 9.2.7.2) Oracle Utilities Applications / General (Apache Commons Text) (4.4.0.3.0, 4.5.0.0.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | BI Application Archive (Apache Commons Text) | 6.4.0.0.0 | 6.4.0.0.0 |
| Oracle Communications | Security (Apache Commons Text) | 22.1.0.0.0 | 22.1.0.0.0 |
| Oracle Communications | Signaling (Apache Commons Text) | 22.3.4, 22.2.3 | 22.2.3 · 22.3.4 |
| Oracle Communications | Virtual Network Function Manager (Apache Common Text) | 8.6.0.0 | 8.6.0.0 |
| Oracle Communications Applications | Core (Apache Commons Text) | 5.5.0-5.5.9, 6.0.0-6.0.1 | |
| Oracle Communications Applications | Installer (Apache Commons Text) | 7.4.0 | 7.4.0 |
| Oracle Communications Applications | PSR Designer (Apache Commons Text) | 7.4.2 | 7.4.2 |
| Oracle Communications Applications | Security (Apache Commons Text) | 12.0.0.3.0-12.0.0.7.0 | |
| Oracle Construction and Engineering | Admin (Apache Commons Text) | 18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10, 21.12.0-21.12.8 | |
| Oracle Enterprise Manager | Management Agent (Apache Commons Text) | 13.4.0.0, 13.5.0.0 | 13.4.0.0 · 13.5.0.0 |
| Oracle Financial Services Applications | Application (Apache Commons Text) | 8.1.2.4 | 8.1.2.4 |
| Oracle Fusion Middleware | Analytics Server (Apache Commons Text) | 5.9.0.0.0, 6.4.0.0.0 | 5.9.0.0.0 · 6.4.0.0.0 |
| Oracle Fusion Middleware | Content Server (Apache Commons Text) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party Patch (Apache Commons Text) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle HealthCare Applications | FHIR (Apache Commons Text) | 8.1.0.0, 8.1.1.0, 8.1.2.0, 8.1.3.0, 8.1.3.2, 8.1.3.4 | 8.1.0.0 · 8.1.1.0 · 8.1.2.0 · 8.1.3.0 · 8.1.3.2 · 8.1.3.4 |
| Oracle HealthCare Applications | Self Service Analytics (Apache Commons Text) | 5.0.0-5.0.4 | 8.1.0 · 8.1.1 · 8.2.0 · 8.2.1 · 8.2.2 |
| Oracle Hyperion | Installation and Configuration (Apache Commons Text) | 11.2.10 | 11.2.10 |
| Oracle JD Edwards | E1 IOT Orchestrator Security (Apache Commons Text) | Prior to 9.2.7.2 | |
| Oracle Retail Applications | DB, Perf, etc (Apache Commons Text) | 18.0.5, 19.0.4, 20.0.3, 21.0.2 | 18.0.5 · 19.0.4 · 20.0.3 · 21.0.2 |
| Oracle Retail Applications | Point of Sale (Apache Commons Text) | 18.0.5, 19.0.4, 20.0.3, 21.0.2 | 18.0.5 · 19.0.4 · 20.0.3 · 21.0.2 |
| Oracle Retail Applications | Security (Apache Commons Text) | 16.0.2, 16.0.3 | 16.0.2 · 16.0.3 |
| Oracle Retail Applications | Xenvironment (Apache Commons Text) | 18.0.5, 19.0.4, 20.0.3, 21.0.2 | 18.0.5 · 19.0.4 · 20.0.3 · 21.0.2 |
| Oracle Utilities Applications | General (Apache Commons Text) | 4.4.0.3.0, 4.5.0.0.0 | 4.4.0.3.0 · 4.5.0.0.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.commons:commons-text |
1.5 | 1.10.0 |
unbounded |
com.guicedee.services:commons-text |
0 | none | 1.2.2.1-jre17 |
Products and versions
5 products, 9 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | commons text | generic | ≥ 1.5 and ＜ 1.10.0 |
| osv | com.guicedee.services | commons-text | generic | ≤ 1.2.2.1.17 |
| nvd | juniper | security threat response manager | generic | 7.5.0 · ＜ 7.5.0 · 7.5.0:up1 · 7.5.0:up2 · 7.5.0:up3 |
| nvd | netapp | bluexp | generic | any version |
| osv | org.apache.commons | commons-text | generic | ≥ 1.5 and ＜ 1.10.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Products:** APACHE-COMMONS-TEXT
References
Timeline
Timeline
| Published | 2022-10-13 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2022-10-18 | Earliest commit adding this CVE's ARMR patch or security rule. |
| VulnCheck KEV: earliest evidence | 2023-01-12 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-08 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |