CVE-2019-10086

Aliases:GHSA-6phf-73q6-gh87
Advisory lineage Upstream: 0 Downstream: 21
Modified
Published: 20 Aug 2019, 20:10
Last modified:04 Aug 2024, 22:10

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
1.24% LOW
1% probability +0.92%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Aug 2019, 20:10
Published
Vulnerability first disclosed
04 Aug 2024, 22:10
Last Modified
Vulnerability information updated

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS Metrics

  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.24%• Percentile: 80%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • apache•apache commons beanutils

    Apache Commons Beanutils 1.0 to 1.9.3

  • apache•commons_beanutils

    ≥ 1.0, ≤ 1.9.3

  • apache•nifi

    1.14.0 | 1.15.0

  • debian•debian_linux

    8.0

  • fedoraproject•fedora

    30 | 31

  • commons-beanutils•commons-beanutils

    < 1.9.4

  • opensuse•leap

    15.0 | 15.1

  • oracle•agile_plm

    9.3.3 | 9.3.5 | 9.3.6

  • oracle•agile_product_lifecycle_management_integration_pack

    3.5 | 3.6

  • oracle•application_testing_suite

    13.3.0.1

  • oracle•banking_platform

    2.4.0 | 2.7.1 | 2.9.0

  • oracle•blockchain_platform

    < 21.1.2

  • oracle•communications_billing_and_revenue_management

    7.5 | 12.0.0.3.0

  • oracle•communications_billing_and_revenue_management_elastic_charging_engine

    11.3.0.9 | 12.0.0.3

  • oracle•communications_cloud_native_core_console

    1.4.0

  • oracle•communications_cloud_native_core_policy

    1.9.0

  • oracle•communications_cloud_native_core_unified_data_repository

    1.6.0

  • oracle•communications_convergence

    3.0.2.2.0

  • oracle•communications_design_studio

    7.3.4 | 7.3.5 | 7.4.0

  • oracle•communications_evolved_communications_application_server

    7.1

  • oracle•communications_metasolv_solution

    6.3.0 | 6.3.1

  • oracle•communications_network_integrity

    7.3.6

  • oracle•communications_performance_intelligence_center

    10.4.0.3

  • oracle•communications_pricing_design_center

    12.0.0.3.0

  • oracle•communications_unified_inventory_management

    7.3.4 | 7.3.5 | 7.4.0 | 7.4.1

  • oracle•customer_management_and_segmentation_foundation

    18.0

  • oracle•enterprise_manager_for_virtualization

    13.4.0.0

  • oracle•financial_services_revenue_management_and_billing_analytics

    2.7 | 2.8

  • oracle•flexcube_private_banking

    12.0.0 | 12.1.0

  • Unknown•Fusion Middleware

    11.1.1.9 | 12.2.1.3.0 | 12.2.1.4.0

  • oracle•healthcare_foundation

    7.1.5 | 7.2.2 | 7.3.0 | 7.3.1 | 8.0.1

  • oracle•hospitality_opera_5

    5.5 | 5.6

  • oracle•hospitality_reporting_and_analytics

    9.1.0

  • oracle•insurance_data_gateway

    1.0.2.3

  • oracle•jd_edwards_enterpriseone_orchestrator

    < 9.2.5.3 | 9.2.5.3

  • oracle•jd_edwards_enterpriseone_tools

    < 9.2.5.3 | 9.2.5.3

  • oracle•peoplesoft_enterprise_peopletools

    8.56 | 8.57

  • oracle•peoplesoft enterprise pt peopletools

    8.56 | 8.57 | 8.58

  • oracle•primavera_gateway

    ≥ 16.2.0, ≤ 16.2.11 | ≥ 17.12.0, ≤ 17.12.6

  • oracle•real-time_decisions_solutions

    3.2.0.0

  • oracle•retail_advanced_inventory_planning

    14.1

  • oracle•retail_back_office

    14.1

  • oracle•retail_central_office

    14.1

  • oracle•retail_invoice_matching

    16.0.3

  • oracle•retail_merchandising_system

    5.0.3.1

  • oracle•retail_point-of-service

    14.1

  • oracle•retail_predictive_application_server

    16.0

  • oracle•retail_price_management

    14.0 | 14.0.1 | 15.0 | 16.0

  • oracle•retail_returns_management

    14.1

  • oracle•retail_xstore_point_of_service

    7.1 | 15.0 | 16.0 | 17.0 | 18.0

Showing first 50 affected entries in server-rendered view.

References (93)