CVE-2019-10086Otomatik saldırıya uygun · CISA
Vulnerability in Apache Commons Beanutils
CVSS Skor
7.3
EPSS İhtimal
%28.4
Risk Skoru
2.1
Yayın
7 yıl önce
Resmî yama doğrulandı
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Envanterimdeki Etkisi
Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.
Oturum kontrol ediliyor…
Zafiyet Açıklaması
DayBreach CVE AI Araştırması
CVE-2019-10086 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
IMPACT — Etkilenen Ürünler ve Yazılımlar
Affected Products
The following products are affected by CVE-2019-10086 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | apache | Apache Commons Beanutils | İncele |
| 2 | apache | commons beanutils | İncele |
| 3 | apache | nifi | İncele |
| 4 | apache | nifi | İncele |
| 5 | debian | debian linux | İncele |
| 6 | opensuse | leap | İncele |
| 7 | opensuse | leap | İncele |
| 8 | fedoraproject | fedora | İncele |
| 9 | fedoraproject | fedora | İncele |
| 10 | redhat | enterprise linux desktop | İncele |
| 11 | redhat | enterprise linux eus | İncele |
| 12 | redhat | enterprise linux server | İncele |
| 13 | redhat | enterprise linux server aus | İncele |
| 14 | redhat | enterprise linux server tus | İncele |
| 15 | redhat | enterprise linux workstation | İncele |
| 16 | redhat | jboss enterprise application platform | İncele |
| 17 | redhat | enterprise linux server | İncele |
| 18 | redhat | enterprise linux server | İncele |
| 19 | oracle | agile product lifecycle management | İncele |
| 20 | oracle | agile product lifecycle management | İncele |
| 21 | oracle | agile product lifecycle management | İncele |
| 22 | oracle | agile product lifecycle management integration pack | İncele |
| 23 | oracle | agile product lifecycle management integration pack | İncele |
| 24 | oracle | application testing suite | İncele |
| 25 | oracle | banking platform | İncele |
| 26 | oracle | banking platform | İncele |
| 27 | oracle | banking platform | İncele |
| 28 | oracle | blockchain platform | İncele |
| 29 | oracle | communications billing and revenue management | İncele |
| 30 | oracle | communications billing and revenue management | İncele |
| 31 | oracle | communications billing and revenue management elastic charging engine | İncele |
| 32 | oracle | communications billing and revenue management elastic charging engine | İncele |
| 33 | oracle | communications cloud native core console | İncele |
| 34 | oracle | communications cloud native core policy | İncele |
| 35 | oracle | communications cloud native core unified data repository | İncele |
| 36 | oracle | communications convergence | İncele |
| 37 | oracle | communications design studio | İncele |
| 38 | oracle | communications design studio | İncele |
| 39 | oracle | communications design studio | İncele |
| 40 | oracle | communications evolved communications application server | İncele |
| 41 | oracle | communications metasolv solution | İncele |
| 42 | oracle | communications metasolv solution | İncele |
| 43 | oracle | communications network integrity | İncele |
| 44 | oracle | communications performance intelligence center | İncele |
| 45 | oracle | communications pricing design center | İncele |
| 46 | oracle | communications unified inventory management | İncele |
| 47 | oracle | communications unified inventory management | İncele |
| 48 | oracle | communications unified inventory management | İncele |
| 49 | oracle | communications unified inventory management | İncele |
| 50 | oracle | customer management and segmentation foundation | İncele |
| 51 | oracle | enterprise manager for virtualization | İncele |
| 52 | oracle | financial services revenue management and billing analytics | İncele |
| 53 | oracle | financial services revenue management and billing analytics | İncele |
| 54 | oracle | flexcube private banking | İncele |
| 55 | oracle | flexcube private banking | İncele |
| 56 | oracle | fusion middleware | İncele |
| 57 | oracle | fusion middleware | İncele |
| 58 | oracle | fusion middleware | İncele |
| 59 | oracle | healthcare foundation | İncele |
| 60 | oracle | healthcare foundation | İncele |
| 61 | oracle | healthcare foundation | İncele |
| 62 | oracle | healthcare foundation | İncele |
| 63 | oracle | healthcare foundation | İncele |
| 64 | oracle | hospitality opera 5 | İncele |
| 65 | oracle | hospitality opera 5 | İncele |
| 66 | oracle | hospitality reporting and analytics | İncele |
| 67 | oracle | insurance data gateway | İncele |
| 68 | oracle | jd edwards enterpriseone orchestrator | İncele |
| 69 | oracle | jd edwards enterpriseone orchestrator | İncele |
| 70 | oracle | jd edwards enterpriseone tools | İncele |
| 71 | oracle | jd edwards enterpriseone tools | İncele |
| 72 | oracle | peoplesoft enterprise peopletools | İncele |
| 73 | oracle | peoplesoft enterprise peopletools | İncele |
| 74 | oracle | peoplesoft enterprise pt peopletools | İncele |
| 75 | oracle | peoplesoft enterprise pt peopletools | İncele |
| 76 | oracle | peoplesoft enterprise pt peopletools | İncele |
| 77 | oracle | primavera gateway | İncele |
| 78 | oracle | primavera gateway | İncele |
| 79 | oracle | real-time decisions solutions | İncele |
| 80 | oracle | retail advanced inventory planning | İncele |
| 81 | oracle | retail back office | İncele |
| 82 | oracle | retail central office | İncele |
| 83 | oracle | retail invoice matching | İncele |
| 84 | oracle | retail merchandising system | İncele |
| 85 | oracle | retail point-of-service | İncele |
| 86 | oracle | retail predictive application server | İncele |
| 87 | oracle | retail price management | İncele |
| 88 | oracle | retail price management | İncele |
| 89 | oracle | retail price management | İncele |
| 90 | oracle | retail price management | İncele |
| 91 | oracle | retail returns management | İncele |
| 92 | oracle | retail xstore point of service | İncele |
| 93 | oracle | retail xstore point of service | İncele |
| 94 | oracle | retail xstore point of service | İncele |
| 95 | oracle | retail xstore point of service | İncele |
| 96 | oracle | retail xstore point of service | İncele |
| 97 | oracle | service bus | İncele |
| 98 | oracle | service bus | İncele |
| 99 | oracle | service bus | İncele |
| 100 | oracle | solaris cluster | İncele |
| 101 | oracle | time and labor | İncele |
| 102 | oracle | utilities framework | İncele |
| 103 | oracle | utilities framework | İncele |
| 104 | oracle | utilities framework | İncele |
| 105 | oracle | utilities framework | İncele |
| 106 | oracle | utilities framework | İncele |
| 107 | oracle | utilities framework | İncele |
| 108 | oracle | weblogic server | İncele |
RED HAT CSAF/VEX — Ürün Etki Kontrolü
Red Hat bu CVE için henüz bir CSAF/VEX etki kaydı yayımlamamış. Bu durum “etkilenmiyor” anlamına gelmez.
SCORING — CVSS Çoklu Kaynak Skoru
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.5 | CVSS V2 | — | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD |
| 7.3 | CVSS V31 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD |
Yama ve İyileştirme Rehberi (Solution)
Solution & Remediation Advisory
8 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.
Public exploit ve aktif sömürü durumu
Doğrulanmış exploit istihbaratı
Bu CVE için henüz doğrulanmış public PoC, exploit repository’si veya Metasploit modülü bulunamadı.
Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-10086 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2019-10086 weaknesses.
Saldırı Vektörü ve Erişilebilirlik Karakteristiği
ErişimAğ üzerinden
YetkiGerekmiyor
KullanıcıGerekmiyor
Resmi Kaynaklar ve Danışma Bültenleri
[www-announce] 20190815 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.vendor-advisory[debian-lts-announce] 20190824 [SECURITY] [DLA 1896-1] commons-beanutils security updatevendor-advisory[tinkerpop-commits] 20190829 [tinkerpop] branch master updated: Bump commons-beanutils to 1.9.4 for CVE-2019-10086 - CTRvendor-advisoryopenSUSE-SU-2019:2058vendor-advisory[commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.vendor-advisory[commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4.vendor-advisory[commons-issues] 20190925 [GitHub] [commons-validator] jeff-schram opened a new pull request #18: Update pom.xmlvendor-advisory[shiro-dev] 20191001 [jira] [Updated] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fixvendor-advisory[shiro-dev] 20191001 [jira] [Created] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fiixvendor-advisory[shiro-dev] 20191001 [jira] [Commented] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fixvendor-advisory
İlgili Benzer Açıklar
10.0
CVE-2021-44228 Aktif sömürülüyorImproper input validation in Apache Log4j
Yama doğrulandı Public Exploits:22EPSS %100
10.0
CVE-2015-3306 Aktif sömürülüyorImproper access control in N/a
Geçici çözüm Public Exploits:5EPSS %99
9.8
CVE-2017-5638 Aktif sömürülüyorstruts2: RCE when performing file upload based on Jakarta Multipart parser
Geçici çözüm Public Exploits:10EPSS %100
9.8
CVE-2018-11776 Aktif sömürülüyorstruts2: Using specific results and namespaces can result in a remote code execution
Geçici çözüm Public Exploits:14EPSS %100
9.8
CVE-2025-61882 Aktif sömürülüyorImproper authentication in Oracle Corporation Oracle Concurrent Processing
Geçici çözüm Public Exploits:10EPSS %100
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-10086"