Skip to content
fr Sign in
Not rated

CVE-2019-10086 In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for…

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Affected products and versions

Product Affected versions Fixed in
Apache Commons Beanutils Versions not published

References

Timeline

  1. Published
  2. Last modified
Track this CVE