Strix
26.1K

CVE-2019-10086

HIGHCVSS 7.3/10EPSS 28.84%

Last modified

CVE-2019-10086 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.. EPSS estimates a 28.84% chance of exploitation in the next 30 days.

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Metrics

CVSS 3.1
7.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Probability
28.84%

97.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheCommons Beanutils>= 1.0, <= 1.9.3
ApacheNifi1.14.0
ApacheNifi1.15.0
DebianDebian Linux8.0
OpensuseLeap15.0
OpensuseLeap15.1
FedoraprojectFedora30
FedoraprojectFedora31
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Eus7.7
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Server Aus7.7
RedhatEnterprise Linux Server Tus7.7
RedhatEnterprise Linux Workstation7.0
RedhatJboss Enterprise Application Platform7.2.0
OracleAgile Plm9.3.3
OracleAgile Plm9.3.5
OracleAgile Plm9.3.6
OracleAgile Product Lifecycle Management Integration Pack3.5
OracleAgile Product Lifecycle Management Integration Pack3.6
OracleApplication Testing Suite13.3.0.1
OracleBanking Platform2.4.0
OracleBanking Platform2.7.1
OracleBanking Platform2.9.0
OracleBlockchain Platform< 21.1.2
OracleCommunications Billing And Revenue Management7.5
OracleCommunications Billing And Revenue Management12.0.0.3.0
OracleCommunications Billing And Revenue Management Elastic Charging Engine11.3.0.9
OracleCommunications Billing And Revenue Management Elastic Charging Engine12.0.0.3
OracleCommunications Cloud Native Core Console1.4.0
OracleCommunications Cloud Native Core Policy1.9.0
OracleCommunications Cloud Native Core Unified Data Repository1.6.0
OracleCommunications Convergence3.0.2.2.0
OracleCommunications Design Studio7.3.4
OracleCommunications Design Studio7.3.5
OracleCommunications Design Studio7.4.0
OracleCommunications Evolved Communications Application Server7.1
OracleCommunications Metasolv Solution6.3.0
OracleCommunications Metasolv Solution6.3.1
OracleCommunications Network Integrity7.3.6
OracleCommunications Performance Intelligence Center10.4.0.3
OracleCommunications Pricing Design Center12.0.0.3.0
OracleCommunications Unified Inventory Management7.3.4
OracleCommunications Unified Inventory Management7.3.5
OracleCommunications Unified Inventory Management7.4.0
OracleCommunications Unified Inventory Management7.4.1
OracleCustomer Management And Segmentation Foundation18.0
OracleEnterprise Manager For Virtualization13.4.0.0
OracleFinancial Services Revenue Management And Billing Analytics2.7
OracleFinancial Services Revenue Management And Billing Analytics2.8

Showing 50 of 105 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-10086?
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
How severe is CVE-2019-10086?
CVE-2019-10086 has a CVSS score of 7.3/10 (HIGH severity). The EPSS model estimates a 28.84% probability of exploitation in the next 30 days.
How do I fix CVE-2019-10086?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2019

View all 2019CVEs →

Are you affected by CVE-2019-10086?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST