~ / search / GHSA-6phf-73q6-gh87

GHSA-6phf-73q6-gh87

Insecure Deserialization in Apache Commons Beanutils

Source: GitHub Advisory Database (reviewed) High CVE-2019-10086

Packages

EcosystemPackageAffectedFixed in
Maven commons-beanutils:commons-beanutils < 1.9.4 1.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

References

External links from the advisory. They lead to third-party sites.