Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Remediation

References

CVE-2019-10086

Related Vulnerabilities

Nexus Repository Manager Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2019-5475)

WordPress Plugin Front File Manager 'upload.php' Arbitrary File Upload (0.1)

OpenSSL Key Management Errors Vulnerability (CVE-2016-7056)

WordPress Plugin Welcart e-Commerce Multiple Vulnerabilities (1.3.12)

XWiki Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Vulnerability (CVE-2022-41931)

Severity

High

Classification

CVE-2019-10086 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities