commons-beanutils:commons-beanutils

3 results · Feed

• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.3
  CVE-2019-10086 EPSS 29%

  Insecure Deserialization in Apache Commons Beanutils

  In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

  Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  Aug 20, 2019
• High —
  CVE-2014-0114 Public exploit EPSS 99%

  Arbitrary code execution in Apache Commons BeanUtils

  Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…

  commons-beanutils commons-beanutils:commons-beanutils commons-beanutils Debian Ubuntu Maven
  Apr 30, 2014