What’s Vulnerable › Vulnerabilities
CVE-2019-10086
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 29.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-20 · updated 2026-10-08
- Weakness: CWE-502
Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Affected products
- Apache Commons Beanutils: from 1.0 through 1.9.3
- Apache Software Foundation Apache NiFi: 1.14.0, 1.15.0
- Debian Linux: 8.0
- Fedoraproject Fedora: 30, 31
- openSUSE Leap: 15.0, 15.1
- Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.5, 9.3.6
- Oracle Agile Product Lifecycle Management Integration Pack: 3.5, 3.6
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Banking Platform: 2.4.0, 2.7.1, 2.9.0
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Corporation Communications Billing and Revenue Management: 7.5, 12.0.0.3.0
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3.0.9, 12.0.0.3
- Oracle Communications Cloud Native Core Console: 1.4.0
- Oracle Communications Cloud Native Core Policy: 1.9.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.6.0
- Oracle Corporation Communications Convergence: 3.0.2.2.0
- Oracle Communications Design Studio: 7.3.4, 7.3.5, 7.4.0
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Communications Metasolv Solution: 6.3.0, 6.3.1
- Oracle Communications Network Integrity: 7.3.6
- Oracle Communications Performance Intelligence Center: 10.4.0.3
- Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.4, 7.3.5, 7.4.0, 7.4.1
- Oracle Customer Management And Segmentation Foundation: 18.0
- Oracle Enterprise Manager For Virtualization: 13.4.0.0
- Oracle Financial Services Revenue Management And Billing Analytics: 2.7, 2.8
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Oracle Enterprise Manager for Fusion Middleware: 11.1.1.9, 12.2.1.3.0, 12.2.1.4.0
- Oracle Healthcare Foundation: 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1
- Oracle Corporation Oracle Hospitality OPERA 5: 5.5, 5.6
How to fix
Upgrade to a fixed version: Oracle Blockchain Platform 21.1.2; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.3; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.3. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
- http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e
- https://access.redhat.com/errata/RHSA-2019:4317
- https://access.redhat.com/errata/RHSA-2020:0057
- https://access.redhat.com/errata/RHSA-2020:0194
- https://access.redhat.com/errata/RHSA-2020:0804
- https://access.redhat.com/errata/RHSA-2020:0805
- https://access.redhat.com/errata/RHSA-2020:0806
- https://access.redhat.com/errata/RHSA-2020:0811
- https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E
- https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E
Get alerted when CVE-2019-10086 or the next vulnerability affects your stack