CVE-2019-10086

HIGH7.3Insecure deserialization

Description

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected products

apache / Apache Commons BeanutilsApache Commons Beanutils 1.0 to 1.9.3 – Apache Commons Beanutils 1.0 to 1.9.3
apache / commons_beanutils1.0 – 1.9.3
apache / nifi1.14.0 – 1.14.0
apache / nifi1.15.0 – 1.15.0
debian / debian_linux8.0 – 8.0
fedoraproject / fedora30 – 30
fedoraproject / fedora31 – 31
openSUSE / Leap15.0 – 15.0
openSUSE / Leap15.1 – 15.1
oracle / agile_product_lifecycle_management9.3.3 – 9.3.3
oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
oracle / agile_product_lifecycle_management9.3.5 – 9.3.5
oracle / agile_product_lifecycle_management_integration_pack3.6 – 3.6
oracle / agile_product_lifecycle_management_integration_pack3.5 – 3.5
oracle / agile_product_lifecycle_management_integration_pack3.5 – 3.5
oracle / agile_product_lifecycle_management_integration_pack3.6 – 3.6
oracle / Application Testing Suite13.3.0.1 – 13.3.0.1
oracle / banking_platform2.7.1 – 2.7.1
oracle / banking_platform2.9.0 – 2.9.0
oracle / banking_platform2.4.0 – 2.4.0
oracle / blockchain_platform21.1.2
oracle / communications_billing_and_revenue_management7.5 – 7.5
oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
oracle / communications_billing_and_revenue_management_elastic_charging_engine11.3.0.9 – 11.3.0.9
oracle / communications_billing_and_revenue_management_elastic_charging_engine12.0.0.3 – 12.0.0.3
oracle / communications_cloud_native_core_console1.4.0 – 1.4.0
oracle / communications_cloud_native_core_policy1.9.0 – 1.9.0
oracle / communications_cloud_native_core_unified_data_repository1.6.0 – 1.6.0
oracle / communications_convergence3.0.2.2.0 – 3.0.2.2.0
oracle / communications_design_studio7.3.5 – 7.3.5
oracle / communications_design_studio7.3.4 – 7.3.4
oracle / communications_design_studio7.4.0 – 7.4.0
oracle / communications_evolved_communications_application_server7.1 – 7.1
oracle / communications_metasolv_solution6.3.0 – 6.3.0
oracle / communications_metasolv_solution6.3.1 – 6.3.1
oracle / communications_network_integrity7.3.6 – 7.3.6
oracle / communications_performance_intelligence_center10.4.0.3 – 10.4.0.3
oracle / communications_pricing_design_center12.0.0.3.0 – 12.0.0.3.0
oracle / communications_unified_inventory_management7.4.0 – 7.4.0
oracle / communications_unified_inventory_management7.3.5 – 7.3.5
oracle / communications_unified_inventory_management7.3.4 – 7.3.4
oracle / communications_unified_inventory_management7.4.1 – 7.4.1
oracle / customer_management_and_segmentation_foundation18.0 – 18.0
oracle / enterprise_manager_for_virtualization13.4.0.0 – 13.4.0.0
oracle / financial_services_revenue_management_and_billing_analytics2.7 – 2.7
oracle / financial_services_revenue_management_and_billing_analytics2.8 – 2.8
oracle / FLEXCUBE Private Banking12.0.0 – 12.0.0
oracle / FLEXCUBE Private Banking12.1.0 – 12.1.0
oracle / fusion_middleware11.1.1.9 – 11.1.1.9
oracle / fusion_middleware12.2.1.4.0 – 12.2.1.4.0
oracle / fusion_middleware12.2.1.3.0 – 12.2.1.3.0
oracle / healthcare_foundation7.3.1 – 7.3.1
oracle / healthcare_foundation7.1.5 – 7.1.5
oracle / healthcare_foundation7.2.2 – 7.2.2
oracle / healthcare_foundation7.3.0 – 7.3.0
oracle / healthcare_foundation8.0.1 – 8.0.1
oracle / hospitality_opera_55.6 – 5.6
oracle / hospitality_opera_55.5 – 5.5
oracle / hospitality_reporting_and_analytics9.1.0 – 9.1.0
oracle / insurance_data_gateway1.0.2.3 – 1.0.2.3
oracle / jd_edwards_enterpriseone_orchestrator9.2.5.3
oracle / jd_edwards_enterpriseone_orchestrator9.2.5.3 – 9.2.5.3
oracle / jd_edwards_enterpriseone_tools9.2.5.3
oracle / jd_edwards_enterpriseone_tools9.2.5.3 – 9.2.5.3
oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
oracle / peoplesoft_enterprise_peopletools8.56 – 8.56
oracle / peoplesoft_enterprise_pt_peopletools8.56 – 8.56
oracle / peoplesoft_enterprise_pt_peopletools8.57 – 8.57
oracle / peoplesoft_enterprise_pt_peopletools8.58 – 8.58
oracle / primavera_gateway16.2.0 – 16.2.11
oracle / real-time_decisions_solutions3.2.0.0 – 3.2.0.0
oracle / retail_advanced_inventory_planning14.1 – 14.1
oracle / retail_back_office14.1 – 14.1
oracle / retail_central_office14.1 – 14.1
oracle / retail_invoice_matching16.0.3 – 16.0.3
oracle / retail_merchandising_system5.0.3.1 – 5.0.3.1
oracle / retail_point-of-service14.1 – 14.1
oracle / retail_predictive_application_server16.0 – 16.0
oracle / retail_price_management15.0 – 15.0
oracle / retail_price_management16.0 – 16.0
oracle / retail_price_management14.0.1 – 14.0.1
oracle / retail_price_management14.0 – 14.0
oracle / retail_returns_management14.1 – 14.1
oracle / retail_xstore_point_of_service7.1 – 7.1
oracle / retail_xstore_point_of_service18.0 – 18.0
oracle / retail_xstore_point_of_service17.0 – 17.0
oracle / retail_xstore_point_of_service16.0 – 16.0
oracle / retail_xstore_point_of_service15.0 – 15.0
oracle / service_bus12.2.1.3.0 – 12.2.1.3.0
oracle / service_bus12.2.1.4.0 – 12.2.1.4.0
oracle / service_bus11.1.1.9.0 – 11.1.1.9.0
oracle / solaris_cluster4.4 – 4.4
oracle / time_and_labor12.2.6 – 12.2.11
oracle / utilities_framework4.2.0.2.0 – 4.2.0.2.0
oracle / utilities_framework4.2.0.3.0 – 4.2.0.3.0
oracle / utilities_framework4.3.0.1.0 – 4.3.0.6.0
oracle / utilities_framework4.4.0.2.0 – 4.4.0.2.0
oracle / utilities_framework4.4.0.3.0 – 4.4.0.3.0
oracle / utilities_framework4.4.0.0.0 – 4.4.0.0.0
oracle / weblogic_server10.3.6.0.0 – 10.3.6.0.0
RedHat / enterprise_linux_desktop7.0 – 7.0
RedHat / enterprise_linux_eus7.7 – 7.7
RedHat / enterprise_linux_server7.0 – 7.0
RedHat / enterprise_linux_server_aus7.7 – 7.7
RedHat / enterprise_linux_server_tus7.7 – 7.7
RedHat / enterprise_linux_workstation7.0 – 7.0
RedHat / jboss_enterprise_application_platform7.2.0 – 7.2.0

References

Updated 17m ago · 8 sources