CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
- Score
- CVSS 3.1 7.3 High
- Status
- Modified - security@apache.org
- Published
- 2019-08-20
- Last modified
- 2026-10-08
- Weaknesses
- CWE-502
Affected products
- Apache Commons Beanutils (Apache)
- Commons Beanutils (Apache)
- Nifi (Apache)
- Debian Linux (Debian)
- Fedora (Fedoraproject)
- Leap (Opensuse)
- Agile Product Lifecycle Management (Oracle)
- Agile Product Lifecycle Management Integration Pack (Oracle)
- Application Testing Suite (Oracle)
- Banking Platform (Oracle)
- Blockchain Platform (Oracle)
- Communications Billing And Revenue Management (Oracle)
- Communications Billing And Revenue Management Elastic Charging Engine (Oracle)
- Communications Cloud Native Core Console (Oracle)
- Communications Cloud Native Core Policy (Oracle)
- Communications Cloud Native Core Unified Data Repository (Oracle)
- Communications Convergence (Oracle)
- Communications Design Studio (Oracle)
- Communications Evolved Communications Application Server (Oracle)
- Communications Metasolv Solution (Oracle)
- Communications Network Integrity (Oracle)
- Communications Performance Intelligence Center (Oracle)
- Communications Pricing Design Center (Oracle)
- Communications Unified Inventory Management (Oracle)
- Customer Management And Segmentation Foundation (Oracle)
- Enterprise Manager For Virtualization (Oracle)
- Financial Services Revenue Management And Billing Analytics (Oracle)
- Flexcube Private Banking (Oracle)
- Fusion Middleware (Oracle)
- Healthcare Foundation (Oracle)
- Hospitality Opera 5 (Oracle)
- Hospitality Reporting And Analytics (Oracle)
- Insurance Data Gateway (Oracle)
- Jd Edwards Enterpriseone Orchestrator (Oracle)
- Jd Edwards Enterpriseone Tools (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
- Peoplesoft Enterprise Pt Peopletools (Oracle)
- Primavera Gateway (Oracle)
- Real-time Decisions Solutions (Oracle)
- Retail Advanced Inventory Planning (Oracle)
- Retail Back Office (Oracle)
- Retail Central Office (Oracle)
- Retail Invoice Matching (Oracle)
- Retail Merchandising System (Oracle)
- Retail Point-of-service (Oracle)
- Retail Predictive Application Server (Oracle)
- Retail Price Management (Oracle)
- Retail Returns Management (Oracle)
- Retail Xstore Point Of Service (Oracle)
- Service Bus (Oracle)
- Solaris Cluster (Oracle)
- Time And Labor (Oracle)
- Utilities Framework (Oracle)
- Weblogic Server (Oracle)
- Enterprise Linux Desktop (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux Server (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server Tus (Redhat)
- Enterprise Linux Workstation (Redhat)
- Jboss Enterprise Application Platform (Redhat)
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%…
- https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html
- https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.ap…
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
- https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apach…
- https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apach…
- https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apach…
- https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org…
- https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org…
- https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org…
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org…
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org…
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.…
- https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org…
- https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIF…
- https://access.redhat.com/errata/RHSA-2019:4317
- https://access.redhat.com/errata/RHSA-2020:0057
- https://access.redhat.com/errata/RHSA-2020:0194
- https://access.redhat.com/errata/RHSA-2020:0806
- https://access.redhat.com/errata/RHSA-2020:0811
- https://access.redhat.com/errata/RHSA-2020:0804
- https://access.redhat.com/errata/RHSA-2020:0805
- https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache…
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.or…
- https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.or…
