CVE-2019-10086
HighCVSS 7.3Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. However, this was not used by default by PropertyUtilsBean.
Risk Assessment
An attacker may exploit access to the classloader to perform attacks such as remote code execution or privilege escalation.
Recommendation
Upgrade Apache Commons Beanutils to version 1.9.3 or later, which uses this protection by default.
Original NVD description (English source)
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.