NetSight
IP …
high7.3

CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader vi…

Impact

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Affected products

VendorProductAffected versions
ApacheCommons Beanutils
from 1.0 through 1.9.3
ApacheNifi
Versions 1.14.0, 1.15.0
DebianDebian Linux
Version 8.0
OpensuseLeap
Versions 15.0, 15.1
FedoraprojectFedora
Versions 30, 31
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Version 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Version 7.7
RedhatEnterprise Linux Server Tus
Version 7.7
RedhatEnterprise Linux Workstation
Version 7.0
RedhatJboss Enterprise Application Platform
Version 7.2.0

Weakness classification

CWE-502

References