CVEvulnerability

CVE-2019-10086

7.3 HIGH Published 2019-08-20 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2019-08-20
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Affected configurations

• apache commons beanutils (>= 1.0 <= 1.9.3) • apache nifi 1.14.0 • apache nifi 1.15.0 • debian debian linux 8.0 • opensuse leap 15.0 • opensuse leap 15.1 • fedoraproject fedora 30 • fedoraproject fedora 31 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server tus 7.7 • redhat enterprise linux workstation 7.0 • redhat jboss enterprise application platform 7.2.0 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle agile product lifecycle management integration pack 3.5 • oracle agile product lifecycle management integration pack 3.6 • oracle application testing suite 13.3.0.1 • oracle banking platform 2.4.0 • oracle banking platform 2.7.1 • oracle banking platform 2.9.0 • oracle blockchain platform (< 21.1.2) • oracle communications billing and revenue management 7.5 • oracle communications billing and revenue management 12.0.0.3.0 • oracle communications billing and revenue management elastic charging engine 11.3.0.9 • oracle communications billing and revenue management elastic charging engine 12.0.0.3 • oracle communications cloud native core console 1.4.0 • oracle communications cloud native core policy 1.9.0 • oracle communications cloud native core unified data repository 1.6.0 • oracle communications convergence 3.0.2.2.0 • oracle communications design studio 7.3.4 • oracle communications design studio 7.3.5 • oracle communications design studio 7.4.0 • oracle communications evolved communications application server 7.1 • oracle communications metasolv solution 6.3.0 • oracle communications metasolv solution 6.3.1 • oracle communications network integrity 7.3.6 • oracle communications performance intelligence center 10.4.0.3 • oracle communications pricing design center 12.0.0.3.0 • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle communications unified inventory management 7.4.0 • oracle communications unified inventory management 7.4.1 • oracle customer management and segmentation foundation 18.0 • oracle enterprise manager for virtualization 13.4.0.0 • oracle financial services revenue management and billing analytics 2.7 • oracle financial services revenue management and billing analytics 2.8 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle fusion middleware 11.1.1.9 • oracle fusion middleware 12.2.1.3.0 • oracle fusion middleware 12.2.1.4.0 • oracle healthcare foundation 7.1.5 • oracle healthcare foundation 7.2.2 • oracle healthcare foundation 7.3.0 • oracle healthcare foundation 7.3.1 • oracle healthcare foundation 8.0.1 … and 45 more

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References