Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Affected products
apache: commons beanutils; apache: nifi; debian: debian linux; opensuse: leap; fedoraproject: fedora; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server tus; redhat: enterprise linux workstation; redhat: jboss enterprise application platform; oracle: agile product lifecycle management; oracle: agile product lifecycle management integration pack; oracle: application testing suite
References10
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2020.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
Metrics
- CVSS 3.1
-
7.3
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - EPSS — exploit probability
- 29% percentile: 98 · as of 3 November 2026
- CWE
- CWE-502
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.