In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Project Subscriptions

Vendors Products
Commons Beanutils Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Opensuse Subscribe
Agile Plm Subscribe
Agile Product Lifecycle Management Integration Pack Subscribe
Application Testing Suite Subscribe
Banking Platform Subscribe
Blockchain Platform Subscribe
Communications Billing And Revenue Management Subscribe
Communications Billing And Revenue Management Elastic Charging Engine Subscribe
Communications Cloud Native Core Console Subscribe
Communications Cloud Native Core Policy Subscribe
Communications Cloud Native Core Unified Data Repository Subscribe
Communications Convergence Subscribe
Communications Design Studio Subscribe
Communications Evolved Communications Application Server Subscribe
Communications Metasolv Solution Subscribe
Communications Network Integrity Subscribe
Communications Performance Intelligence Center Subscribe
Communications Pricing Design Center Subscribe
Communications Unified Inventory Management Subscribe
Customer Management And Segmentation Foundation Subscribe
Enterprise Manager For Virtualization Subscribe
Financial Services Revenue Management And Billing Analytics Subscribe
Flexcube Private Banking Subscribe
Fusion Middleware Subscribe
Healthcare Foundation Subscribe
Hospitality Opera 5 Subscribe
Hospitality Reporting And Analytics Subscribe
Insurance Data Gateway Subscribe
Jd Edwards Enterpriseone Orchestrator Subscribe
Jd Edwards Enterpriseone Tools Subscribe
Peoplesoft Enterprise Peopletools Subscribe
Peoplesoft Enterprise Pt Peopletools Subscribe
Primavera Gateway Subscribe
Real-time Decisions Solutions Subscribe
Retail Advanced Inventory Planning Subscribe
Retail Back Office Subscribe
Retail Central Office Subscribe
Retail Invoice Matching Subscribe
Retail Merchandising System Subscribe
Retail Point-of-service Subscribe
Retail Predictive Application Server Subscribe
Retail Price Management Subscribe
Retail Returns Management Subscribe
Retail Xstore Point Of Service Subscribe
Service Bus Subscribe
Solaris Cluster Subscribe
Time And Labor Subscribe
Utilities Framework Subscribe
Weblogic Server Subscribe
Enterprise Linux Subscribe
Enterprise Linux Desktop Subscribe
Enterprise Linux Eus Subscribe
Enterprise Linux Server Subscribe
Enterprise Linux Server Aus Subscribe
Enterprise Linux Server Tus Subscribe
Enterprise Linux Workstation Subscribe
Jboss Data Grid Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Application Platform Cd Subscribe
Jboss Enterprise Application Platform Eus Subscribe
Jboss Enterprise Bpms Platform Subscribe
Jboss Enterprise Brms Platform Subscribe
Jboss Fuse Subscribe
Jboss Single Sign On Subscribe
Openshift Application Runtimes Subscribe
Rhel Software Collections Subscribe
Rhev Manager Subscribe
Satellite Subscribe
Satellite Capsule Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-1896-1 commons-beanutils security update
EUVD EUVD EUVD-2020-0465 In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Github GHSA Github GHSA GHSA-6phf-73q6-gh87 Insecure Deserialization in Apache Commons Beanutils
Ubuntu USN Ubuntu USN USN-4766-1 Apache Commons BeanUtils vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html cve-icon cve-icon
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:4317 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0057 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0194 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0804 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0805 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0806 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0811 cve-icon cve-icon
https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt cve-icon
https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-10086 cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-10086 cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00383}

epss

{'score': 0.00321}


Mon, 23 Jun 2025 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb

Sun, 08 Dec 2024 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhev_manager:4.4:el8

Mon, 26 Aug 2024 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2024-08-04T22:10:09.585Z

Reserved: 2019-03-26T00:00:00.000Z

Link: CVE-2019-10086

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-08-20T21:15:12.057

Modified: 2024-11-21T04:18:22.250

Link: CVE-2019-10086

cve-icon Redhat

Severity : Important

Publid Date: 2019-08-15T00:00:00Z

Links: CVE-2019-10086 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses