Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Published: 2019-08-20
Score: 7.3 High
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-1896-1 commons-beanutils security update
EUVD EUVD EUVD-2020-0465 In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Github GHSA Github GHSA GHSA-6phf-73q6-gh87 Insecure Deserialization in Apache Commons Beanutils
Ubuntu USN Ubuntu USN USN-4766-1 Apache Commons BeanUtils vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html cve-icon cve-icon
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:4317 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0057 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0194 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0804 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0805 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0806 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0811 cve-icon cve-icon
https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt cve-icon
https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-10086 cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-10086 cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00383}

epss

{'score': 0.00321}


Mon, 23 Jun 2025 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb

Sun, 08 Dec 2024 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhev_manager:4.4:el8

Mon, 26 Aug 2024 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Subscriptions

Apache Commons Beanutils Nifi
Debian Debian Linux
Fedoraproject Fedora
Opensuse Leap
Oracle Agile Plm Agile Product Lifecycle Management Integration Pack Application Testing Suite Banking Platform Blockchain Platform Communications Billing And Revenue Management Communications Billing And Revenue Management Elastic Charging Engine Communications Cloud Native Core Console Communications Cloud Native Core Policy Communications Cloud Native Core Unified Data Repository Communications Convergence Communications Design Studio Communications Evolved Communications Application Server Communications Metasolv Solution Communications Network Integrity Communications Performance Intelligence Center Communications Pricing Design Center Communications Unified Inventory Management Customer Management And Segmentation Foundation Enterprise Manager For Virtualization Financial Services Revenue Management And Billing Analytics Flexcube Private Banking Fusion Middleware Healthcare Foundation Hospitality Opera 5 Hospitality Reporting And Analytics Insurance Data Gateway Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Peoplesoft Enterprise Peopletools Peoplesoft Enterprise Pt Peopletools Primavera Gateway Real-time Decisions Solutions Retail Advanced Inventory Planning Retail Back Office Retail Central Office Retail Invoice Matching Retail Merchandising System Retail Point-of-service Retail Predictive Application Server Retail Price Management Retail Returns Management Retail Xstore Point Of Service Service Bus Solaris Cluster Time And Labor Utilities Framework Weblogic Server
Redhat Enterprise Linux Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Tus Enterprise Linux Workstation Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd Jboss Enterprise Application Platform Eus Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform Jboss Fuse Jboss Single Sign On Openshift Application Runtimes Rhel Software Collections Rhev Manager Satellite Satellite Capsule
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2024-08-04T22:10:09.585Z

Reserved: 2019-03-26T00:00:00.000Z

Link: CVE-2019-10086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-08-20T21:15:12.057

Modified: 2024-11-21T04:18:22.250

Link: CVE-2019-10086

cve-icon Redhat

Severity : Important

Publid Date: 2019-08-15T00:00:00Z

Links: CVE-2019-10086 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses