CVE-2025-48734: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Modified

AliasesMGASA-2025-0299SUSE-SU-2025:01815-1RHSA-2025:10814+299 more

Published 28-05-2025Last modified 29-04-2026

Vulnerability summary

CVE-2025-48734 is a high (CVSS 8.8) Improper Access Control vulnerability in apache software foundation apache commons beanutils 1.x. EPSS estimates a 2.02% chance of exploitation in the next 30 days, higher than 80.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

2.02%

0%100%

Low · +0.19 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

28-05-2025
PublishedVulnerability first disclosed.
29-04-2026
Last modifiedVulnerability information updated.

Description

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

CVSS metrics

8 scores · 8 sources · 1 version

v3.18.8

EPSS trend

Probability

2.02%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

Increase +0.19 pp

From 1.82% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard129 products

akhq< 0.25.1-r4
apache-activemq-artemis< 2.41.0-r4
apache-activemq-artemis-compat< 2.41.0-r4
apache-nifi< 2.4.0-r1
apache-nifi-compat< 2.4.0-r1

apache-nifi-toolkit< 2.4.0-r1
apicurio-registry< 3.0.8-r0
apicurio-registry-nginx-config< 3.0.8-r0
apicurio-registry-ui< 3.0.8-r0
camunda-zeebe-8.6< 8.6.15-r2
camunda-zeebe-8.6-compat< 8.6.15-r2
cassandra-reaper< 3.8.0-r5
celeborn-0.5All versions (No fix recorded)
celeborn-0.6< 0.6.3-r7
confluent-common-docker< 7.6.0-r13
confluent-common-docker-base< 7.6.0-r13
confluent-kafka-jre-bcfips< 8.1.0.11-r0
druid< 37.0.0-r56 | < 37.0.0-r14
eco-java-gradle-1.11All versions (No fix recorded)
ghidra< 11.3.2-r1
hadoop-client-modules< 3.3.6-r3
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r12 | All versions (No fix recorded)
jenkins-2< 2.512-r1
jenkins-2-openjdk-17< 2.512-r1
jenkins-2-openjdk-21< 2.512-r1
jenkins-2.504-openjdk-17< 2.504.2-r1
jenkins-2.504-openjdk-21< 2.504.2-r1
jenkins-compat< 2.512-r1
jenkins-docker-agent-openjdk-21< 2.512-r1
jenkins-plugin-manager< 2.14.0-r0
jenkins-remoting< 2.512-r1
jenkins-utils< 2.512-r1
kafka_exporter-strimzi-compat< 0.46.0-r5
kafka-3.7< 3.7.2-r42
kafka-3.8< 3.8.1-r42
kafka-3.9< 3.9.1-r1
kafka-4.0< 4.0.0-r42
kafka-iamguarded-compat-4.0< 4.0.0-r42
kafka-strimzi-compat< 0.46.0-r5
neo4j-4.4< 4.4.44-r1
neo4j-4.4-docker-publish< 4.4.44-r1
opensearch-2< 2.19.4-r0
prometheus-jmx-exporter-strimzi-compat< 0.46.0-r5
solr-9-full< 9.10.1-r13
solr-fips-9-full< 9.10.1-r1
sonarqube< 25.12.0.117093-r0 | < 25.11.0.114957-r0
sonarqube-10All versions (No fix recorded)
spark-3.5-scala-2.12All versions (No fix recorded) | < 3.5.9-r10
spark-3.5-scala-2.13< 3.5.9-r10 | All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded) | < 3.5.8-r14
spark-fips-3.5-scala-2.13All versions (No fix recorded) | < 3.5.8-r14
spdx-tools-java< 2.0.1-r2
strimzi-kafka-operator< 0.46.0-r5
strimzi-kafka-operator-cluster-operator< 0.46.0-r5
strimzi-kafka-operator-kafka-agent< 0.46.0-r5
strimzi-kafka-operator-kafka-base< 0.46.0-r5
strimzi-kafka-operator-kafka-init< 0.46.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 0.46.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.46.0-r5
strimzi-kafka-operator-topic-operator< 0.46.0-r5
strimzi-kafka-operator-tracing-agent< 0.46.0-r5
strimzi-kafka-operator-user-operator< 0.46.0-r5
tez< 0.10.4-r9
trino< 475-r6
trino-config< 475-r6
trino-oci-entrypoint< 475-r6
trino-plugin-ai-functions< 475-r6
trino-plugin-bigquery< 475-r6
trino-plugin-blackhole< 475-r6
trino-plugin-cassandra< 475-r6
trino-plugin-clickhouse< 475-r6
trino-plugin-delta-lake< 475-r6
trino-plugin-druid< 475-r6
trino-plugin-duckdb< 475-r6
trino-plugin-elasticsearch< 475-r6
trino-plugin-exasol< 475-r6
trino-plugin-exchange-filesystem< 475-r6
trino-plugin-exchange-hdfs< 475-r6
trino-plugin-faker< 475-r6
trino-plugin-functions-python< 475-r6
trino-plugin-geospatial< 475-r6
trino-plugin-google-sheets< 475-r6
trino-plugin-hive< 475-r6
trino-plugin-http-event-listener< 475-r6
trino-plugin-http-server-event-listener< 475-r6
trino-plugin-hudi< 475-r6
trino-plugin-iceberg< 475-r6
trino-plugin-ignite< 475-r6
trino-plugin-jmx< 475-r6
trino-plugin-kafka< 475-r6
trino-plugin-kafka-event-listener< 475-r6
trino-plugin-lakehouse< 475-r6
trino-plugin-ldap-group-provider< 475-r6
trino-plugin-loki< 475-r6
trino-plugin-mariadb< 475-r6
trino-plugin-memory< 475-r6
trino-plugin-ml< 475-r6
trino-plugin-mongodb< 475-r6
trino-plugin-mysql< 475-r6
trino-plugin-mysql-event-listener< 475-r6
trino-plugin-opa< 475-r6
trino-plugin-openlineage< 475-r6
trino-plugin-opensearch< 475-r6
trino-plugin-oracle< 475-r6
trino-plugin-password-authenticators< 475-r6
trino-plugin-pinot< 475-r6
trino-plugin-postgresql< 475-r6
trino-plugin-prometheus< 475-r6
trino-plugin-ranger< 475-r6
trino-plugin-redis< 475-r6
trino-plugin-redshift< 475-r6
trino-plugin-resource-group-managers< 475-r6
trino-plugin-session-property-managers< 475-r6
trino-plugin-singlestore< 475-r6
trino-plugin-snowflake< 475-r6
trino-plugin-spooling-filesystem< 475-r6
trino-plugin-sqlserver< 475-r6
trino-plugin-teradata-functions< 475-r6
trino-plugin-thrift< 475-r6
trino-plugin-tpcds< 475-r6
trino-plugin-tpch< 475-r6
trino-plugin-vertica< 475-r6
wildfly< 36.0.1-r4
wildfly-openjdk-17< 36.0.1-r4
wildfly-openjdk-17-compat< 36.0.1-r4
wildfly-openjdk-21< 36.0.1-r4
wildfly-openjdk-21-compat< 36.0.1-r4

Show all 129

Wolfi68 products

akhq< 0.25.1-r4
apache-activemq-artemis< 2.41.0-r4
apache-activemq-artemis-compat< 2.41.0-r4
apache-nifi< 2.4.0-r1
apache-nifi-compat< 2.4.0-r1

apache-nifi-toolkit< 2.4.0-r1
apicurio-registry< 3.0.8-r0
apicurio-registry-nginx-config< 3.0.8-r0
apicurio-registry-ui< 3.0.8-r0
cassandra-reaper< 3.8.0-r5
celeborn-0.6< 0.6.3-r7
confluent-common-docker< 7.6.0-r13
confluent-common-docker-base< 7.6.0-r13
druid< 37.0.0-r56 | < 37.0.0-r14
jenkins-2< 2.512-r1
jenkins-2-openjdk-17< 2.512-r1
jenkins-2-openjdk-21< 2.512-r1
jenkins-compat< 2.512-r1
jenkins-docker-agent-openjdk-21< 2.512-r1
jenkins-plugin-manager< 2.14.0-r0
jenkins-remoting< 2.512-r1
jenkins-utils< 2.512-r1
kafka_exporter-strimzi-compat< 0.46.0-r5
kafka-strimzi-compat< 0.46.0-r5
opensearch-2< 2.19.4-r0
prometheus-jmx-exporter-strimzi-compat< 0.46.0-r5
sonarqube< 25.12.0.117093-r0 | < 25.11.0.114957-r0
sonarqube-10All versions (No fix recorded)
spdx-tools-java< 2.0.1-r2
strimzi-kafka-operator< 0.46.0-r5
strimzi-kafka-operator-cluster-operator< 0.46.0-r5
strimzi-kafka-operator-kafka-agent< 0.46.0-r5
strimzi-kafka-operator-kafka-base< 0.46.0-r5
strimzi-kafka-operator-kafka-init< 0.46.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 0.46.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.46.0-r5
strimzi-kafka-operator-topic-operator< 0.46.0-r5
strimzi-kafka-operator-tracing-agent< 0.46.0-r5
strimzi-kafka-operator-user-operator< 0.46.0-r5
tez< 0.10.4-r9
trino< 475-r6
trino-config< 475-r6
trino-oci-entrypoint< 475-r6
trino-plugin-ai-functions< 475-r6
trino-plugin-bigquery< 475-r6
trino-plugin-blackhole< 475-r6
trino-plugin-cassandra< 475-r6
trino-plugin-clickhouse< 475-r6
trino-plugin-delta-lake< 475-r6
trino-plugin-druid< 475-r6
trino-plugin-duckdb< 475-r6
trino-plugin-elasticsearch< 475-r6
trino-plugin-exasol< 475-r6
trino-plugin-exchange-filesystem< 475-r6
trino-plugin-exchange-hdfs< 475-r6
trino-plugin-faker< 475-r6
trino-plugin-functions-python< 475-r6
trino-plugin-geospatial< 475-r6
trino-plugin-google-sheets< 475-r6
trino-plugin-hive< 475-r6
trino-plugin-http-event-listener< 475-r6
trino-plugin-http-server-event-listener< 475-r6
trino-plugin-hudi< 475-r6
trino-plugin-iceberg< 475-r6
trino-plugin-ignite< 475-r6
trino-plugin-jmx< 475-r6
trino-plugin-kafka< 475-r6
trino-plugin-kafka-event-listener< 475-r6

Show all 68

Apache software foundation2 products

apache commons beanutils 1.x≥ 1.0, < 1.11.0
apache commons beanutils 2.x≥ 2.0.0-M1, < 2.0.0-M2

Apache1 product

commons_beanutils≥ 1.0, < 1.11.0 | 2.0.0:milestone1

4 vendors · 200 products · Showing 200 of 263

References

51 links

lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9Vendor AdvisoryARTICLEREPORTAdvisoryWEBMailing List
www.openwall.com/lists/oss-security/2025/05/28/6REPORTAdvisoryWEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2025/06/msg00027.htmlWEB
advisories.mageia.org/MGASA-2025-0299.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=34330REPORT
lists.opensuse.org/opensuse-updates/2019-09/msg00017.htmlWEB
www.suse.com/support/update/announcement/2025/suse-su-202501815-1/Advisory
bugzilla.suse.com/1243793REPORT
www.suse.com/security/cve/CVE-2025-48734WEB
access.redhat.com/errata/RHSA-2025:10814Advisory

Show all 51 references