Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2019-10086 @ Maven-commons-beanutils:commons-beanutils-1.9.2 #3

Open
jerp1979 opened this issue Jan 3, 2023 · 0 comments
Open

CVE-2019-10086 @ Maven-commons-beanutils:commons-beanutils-1.9.2 #3

jerp1979 opened this issue Jan 3, 2023 · 0 comments
Labels
branch:master Checkmarx project:jerp1979/java-faker SCA

Comments

@jerp1979
Copy link
Owner

jerp1979 commented Jan 3, 2023 •
edited
Loading

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2019-10086
Checkmarx Project: jerp1979/java-faker
Repository URL: https:/jerp1979/java-faker
Branch: master
Scan ID: 8f3fa71f-fe46-4bc8-9378-781a0403538e

In Apache Commons Beanutils 1.9.2 before 1.9.4, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 1.9.4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
branch:master Checkmarx project:jerp1979/java-faker SCA
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jerp1979