DEBIAN-CVE-2019-10086

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2019-10086
Downstream
DLA-1896-1
Published: 20 Aug 2019, 21:15
Last modified:28 Apr 2026, 20:19

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
7.3 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Aug 2019, 21:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:19
Last Modified
Vulnerability information updated

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS Metrics

  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected Systems

  • debian•commons-beanutils

    < 1.9.4-1 | < 1.9.4-1 | < 1.9.4-1 | < 1.9.4-1

References (1)