CVE-2016-2510: High severity BeanShell BeanShell vulnerability
An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.
A vulnerable application could be exploited for remote code execution, including executing arbitrary shell commands.
External references:
https://github.com/beanshell/beanshell/releases/tag/2.0b6
Upstream patches:
https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49
https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced
Other sources
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2510?
CVE-2016-2510 is rated as a high severity vulnerability due to its ability to allow remote code execution.
How does CVE-2016-2510 allow for exploitation?
CVE-2016-2510 allows remote attackers to execute arbitrary code by using crafted serialized data with vulnerable applications that include BeanShell.
Which versions are affected by CVE-2016-2510?
Versions before BeanShell 2.0b6, including 1.0 and all beta versions up to 2.0b5, are affected by CVE-2016-2510.
How do I fix CVE-2016-2510?
To remediate CVE-2016-2510, upgrade to BeanShell version 2.0 or newer, which addresses the vulnerability.
What are the potential impacts of CVE-2016-2510 on my system?
If exploited, CVE-2016-2510 can compromise system integrity, leading to unauthorized control and data loss.