NexaPulse
Subscribe
7.3highHigh

CVE-2019-10086

Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.3 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-502
Assigned by
security@apache.org

Dates

Published
2019-08-20
Last modified
2026-08-25
Sources
NVD

Affected products

  • Apache Commons Beanutils1.0 - 1.9.3
  • Apache Nifi1.14.0, 1.15.0
  • Debian Debian Linux8.0
  • Opensuse Leap15.0, 15.1
  • Fedoraproject Fedora30, 31
  • Redhat Enterprise Linux Desktop7.0
  • Redhat Enterprise Linux Eus7.7
  • Redhat Enterprise Linux Server7.0, 6.0, 8.0
  • Redhat Enterprise Linux Server Aus7.7
  • Redhat Enterprise Linux Server Tus7.7
  • Redhat Enterprise Linux Workstation7.0
  • Redhat Jboss Enterprise Application Platform7.2.0

As listed in the NVD configuration data. Not a statement about your estate.

References