What is the CVSS score of CVE-2019-10086?

CVE-2019-10086 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 28.8%.

Is there a patch available for CVE-2019-10086?

Yes, a patch is available for CVE-2019-10086. Update the affected software to the latest version immediately.

Java CVE-2019-10086

HIGH

Deserialization of Untrusted Data (CWE-502)

2019-08-20 security@apache.org

Java Apache Deserialization Commons Beanutils Nifi Debian Linux Leap Fedora Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Tus Enterprise Linux Workstation Jboss Enterprise Application Platform Agile Plm Agile Product Lifecycle Management Integration Pack Application Testing Suite Banking Platform Blockchain Platform Communications Billing And Revenue Management Communications Billing And Revenue Management Elastic Charging Engine Communications Cloud Native Core Console Communications Cloud Native Core Policy Communications Cloud Native Core Unified Data Repository Communications Convergence Communications Design Studio Communications Evolved Communications Application Server Communications Metasolv Solution Communications Network Integrity Communications Performance Intelligence Center Communications Pricing Design Center Communications Unified Inventory Management Customer Management And Segmentation Foundation Enterprise Manager For Virtualization Financial Services Revenue Management And Billing Analytics Flexcube Private Banking Fusion Middleware Healthcare Foundation Hospitality Opera 5 Hospitality Reporting And Analytics Insurance Data Gateway Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Peoplesoft Enterprise Peopletools Peoplesoft Enterprise Pt Peopletools Primavera Gateway Real Time Decisions Solutions Retail Advanced Inventory Planning Retail Back Office Retail Central Office Retail Invoice Matching Retail Merchandising System Retail Point Of Service Retail Predictive Application Server Retail Price Management Retail Returns Management Retail Xstore Point Of Service Service Bus Solaris Cluster Time And Labor Utilities Framework Weblogic Server

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Aug 20, 2019 - 21:15 nvd

HIGH 7.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19,024 maven packages depend on commons-beanutils:commons-beanutils (2,350 direct, 16,776 indirect)

Ecosystem-wide dependent count for version 1.9.4.

DescriptionNVD

AnalysisAI

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. Affected products include: Apache Commons Beanutils, Apache Nifi, Debian Debian Linux, Opensuse Leap, Fedoraproject Fedora.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.