CVE-2025-48734
published 2025-05-28CVE-2025-48734: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.55%
72.3th percentile
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_beanutils | — | — |
| apache | commons_beanutils | >= 1.0 < 1.11.0 | 1.11.0 |
| apache_software_foundation | apache_commons_beanutils_1.x | >= 1.0 < 1.11.0 | 1.11.0 |
| apache_software_foundation | apache_commons_beanutils_2.x | >= 2.0.0-M1 < 2.0.0-M2 | 2.0.0-M2 |
| debian | commons-beanutils | < commons-beanutils 1.9.4-1+deb12u1 (bookworm) | commons-beanutils 1.9.4-1+deb12u1 (bookworm) |
| ubuntu | commons-beanutils | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Audit applications using Apache Commons BeanUtils 1.x before 1.11.0 or 2.x before 2.0.0-M2 that pass untrusted/external property paths directly to getProperty() or getNestedProperty() — these are the vulnerable code paths ↗
- ·The suppression BeanIntrospector for 'declaredClass' is enabled by default in fixed versions (1.11.0 / 2.0.0-M2), but can be explicitly disabled by configuration — verify it has not been disabled in deployed applications ↗
- ·Protection via BeanIntrospector existed since version 1.9.2 but was NOT enabled by default, meaning applications on 1.9.2–1.10.x were vulnerable unless they explicitly enabled the suppressor ↗
- ·Both artifact coordinates are affected and must be checked: 'commons-beanutils:commons-beanutils' (1.x, fix in 1.11.0) and 'org.apache.commons:commons-beanutils2' (2.x, fix in 2.0.0-M2) ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_oracle8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache Commons BeanUtils vulnerability
vendor_ubuntu·2026-05-27
CVE-2025-48734 Apache Commons BeanUtils vulnerability
Title: Apache Commons BeanUtils vulnerability
Summary: Apache Commons BeanUtils could be made to run programs if it received
specially crafted input.
It was discovered that Apache Commons BeanUtils incorrectly allowed
access to the declaredClass property of Java enum objects when handling
externally supplied property paths. An attacker could possibly use this
issue to execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Commons BeanUtils) — CVE-2025-48734
vendor_oracle·2026-01-15·CVSS 8.8
CVE-2025-48734 [HIGH] Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Commons BeanUtils) — CVE-2025-48734
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Commons BeanUtils) vulnerability
CVE: CVE-2025-48734
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Commons BeanUtils) — CVE-2025-48734
vendor_oracle·2025-10-15·CVSS 6.8
CVE-2025-48734 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (Apache Commons BeanUtils) — CVE-2025-48734
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Commons BeanUtils) vulnerability
CVE: CVE-2025-48734
CVSS: 6.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Third Party (Apache Commons BeanUtils) — CVE-2025-48734
vendor_oracle·2025-07-15·CVSS 8.8
CVE-2025-48734 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Third Party (Apache Commons BeanUtils) — CVE-2025-48734
Oracle Oracle Communications Applications Risk Matrix: Third Party (Apache Commons BeanUtils) vulnerability
CVE: CVE-2025-48734
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Red Hat
commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
vendor_redhat·2025-05-28·CVSS 8.8
CVE-2025-48734 [HIGH] CWE-284 commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtil
Debian
CVE-2025-48734: commons-beanutils - Improper Access Control vulnerability in Apache Commons. A special BeanIntros...
vendor_debian·2025·CVSS 8.8
CVE-2025-48734 [HIGH] CVE-2025-48734: commons-beanutils - Improper Access Control vulnerability in Apache Commons. A special BeanIntros...
Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Acc
OSV
CVE-2025-48734: Improper Access Control vulnerability in Apache Commons
osv·2025-05-28·CVSS 8.8
CVE-2025-48734 [HIGH] CVE-2025-48734: Improper Access Control vulnerability in Apache Commons
Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Acc
OSV
Apache Commons Improper Access Control vulnerability
osv·2025-05-28
CVE-2025-48734 [HIGH] Apache Commons Improper Access Control vulnerability
Apache Commons Improper Access Control vulnerability
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declare
GHSA
Apache Commons Improper Access Control vulnerability
ghsa·2025-05-28
CVE-2025-48734 [HIGH] CWE-284 Apache Commons Improper Access Control vulnerability
Apache Commons Improper Access Control vulnerability
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declare
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-48734 commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
bugzilla·2025-05-28·CVSS 8.8
CVE-2025-48734 [HIGH] CVE-2025-48734 commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
CVE-2025-48734 commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() met
Bugzilla
CVE-2025-48734 javapackages-bootstrap: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [fedora-42]
bugzilla·2025-05-28·CVSS 8.8
CVE-2025-48734 [HIGH] CVE-2025-48734 javapackages-bootstrap: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [fedora-42]
CVE-2025-48734 javapackages-bootstrap: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2368956
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this b
Qualys
Oracle Critical Patch Update, July 2025 Security Update Review
blogs_qualys·2025-07-16
Oracle Critical Patch Update, July 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 309 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 84, constituting about 27% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 40 and 36 security patches.
228 of the 309 security patches provided by the July Critical Patch Update (about 74%) are for non-Oracle CVEs, su
Qualys
Oracle Critical Patch Update, July 2025 Security Update Review | Qualys
blogs_qualys·2025-07-16
Oracle Critical Patch Update, July 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 309 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 84, constituting about 27% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 40 and 36 security patches.
228 of the 309 security patches provided by the July Critical Patch Update (about 74%) are for non-Oracle CVE
2025-05-28
Published