GitHub Advisoryadvisory · Maven

GHSA-6phf-73q6-gh87 Insecure Deserialization in Apache Commons Beanutils

HIGH Published 2020-06-15 Modified 2022-02-08 Official page ↗
Aliases
CVE-2019-10086
Ecosystem
Maven
Packages
commons-beanutils:commons-beanutils
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-502
Reviewed
2020-06-11

Affected packages

• Maven commons-beanutils:commons-beanutils: < 1.9.4 → fixed in 1.9.4

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Related

Alias · CVE (1)

  • CVE-2019-10086 In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References