CVE-2019-10086

Apache Apache Commons Beanutils

HIGH 7.3

En bref

Source: NVD
EPSS: EPSS 29.08 % · centile 98 (2026-10-28)
État: PUBLISHED
Publiée: 2019-08-20 20:10 UTC
Mise à jour: 2026-10-08 21:13 UTC
Attribuée par: apache
Statut NVD: Modified

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Faiblesses (CWE)

CWE-502 — Désérialisation de données non fiables

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-6phf-73q6-gh87 — Insecure Deserialization in Apache Commons Beanutils

Références européennes

ENISA EUVD · EUVD-2020-0465
GCVE · GCVE-0-2019-10086

Avis du CERT-FR

CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2022-AVI-266 — Multiples vulnérabilités dans IBM WebSphere Service Registry and Repository · cert.ssi.gouv.fr
CERTFR-2021-AVI-560 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
CERTFR-2021-AVI-300 — Multiples vulnérabilités dans Oracle WebLogic · cert.ssi.gouv.fr
CERTFR-2021-AVI-047 — Multiples vulnérabilités dans Oracle WebLogic · cert.ssi.gouv.fr
CERTFR-2021-AVI-044 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
CERTFR-2020-AVI-433 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:* ≥ 1.0 ≤ 1.9.3
cpe:2.3:a:apache:nifi:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:nifi:1.15.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:e-business_suite:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:sap:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:sap:*:*
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* < 21.1.2
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:*
+67 autres

Produits affectés

Produit	Versions
Apache · Apache Commons Beanutils	affected Apache Commons Beanutils 1.0 to 1.9.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD