VDB
VAR-201404-0288
VAR-201404-0288
PUBLISHED
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
Timeline
- Mar 7, 2011 CVE Published
- Mar 6, 2014 PoC Published
- Sep 6, 2015 PoC Published
- Feb 14, 2016 PoC Published
- May 29, 2018 PoC Published
- Feb 6, 2025 PoC Published
- Feb 23, 2025 PoC Published
- Aug 31, 2025 PoC Published
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Distribution Patch
References
- 57477 third-party-advisory
- https://issues.apache.org/jira/browse/BEANUTILS-463 url
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html url
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html url
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html url
- FEDORA-2014-9380 vendor-advisory
- https://security.netapp.com/advisory/ntap-20140911-0001/ url
- http://www-01.ibm.com/support/docview.wss?uid=swg21675387 url
- https://access.redhat.com/solutions/869353 url
- http://advisories.mageia.org/MGASA-2014-0219.html url
- http://www-01.ibm.com/support/docview.wss?uid=swg21675972 url
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 url
- http://www-01.ibm.com/support/docview.wss?uid=swg21676375 url
- [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE mailing-list
- RHSA-2018:2669 vendor-advisory
- HPSBST03160 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html url
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html url
- http://www-01.ibm.com/support/docview.wss?uid=swg27042296 url
- 59246 third-party-advisory
…and 99 more