High severity · published Aug 20, 2019
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property…
7.3
CVSS
29.1%
EPSS
No
On KEV
Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)29.1% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
Fusion Middleware · Oracle
11.1.1.9; 12.2.1.3.0; 12.2.1.4.0 · source: NVD
WS
WebLogic Server · Oracle
10.3.6.0.0 · source: NVD
AC
Apache Commons Beanutils · Apache
Apache Commons Beanutils 1.0 to 1.9.3 · source: vendor
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.5; 9.3.6 · source: NVD
AP
Agile Product Lifecycle Management Integration Pack · Oracle
3.5; 3.5; 3.6; 3.6 · source: NVD
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
BP
Banking Platform · Oracle
2.4.0; 2.7.1; 2.9.0 · source: NVD
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
CB
Commons Beanutils · Apache
1.0 through 1.9.3 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5; 12.0.0.3.0 · source: NVD
CB
Communications Billing And Revenue Management Elastic Charging Engine · Oracle
11.3.0.9; 12.0.0.3 · source: NVD
CC
Communications Cloud Native Core Console · Oracle
1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10086
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4317
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0057
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0194
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0804
More from Fusion Middleware
9.8
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
9.8
CVE-2021-35587
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2012-1710
Oracle Fusion Middleware Unspecified Vulnerability
9.1
CVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability