REDHAT-BUG-1116665: High severity apache commons beanutils vulnerability
It was found that commons-beanutils exposes the class property by default, with no mechanism to disable access to it. If a framework built on commons-beanutils does not otherwise suppress access to the class property, then a remote attacker could use this flaw to manipulate the ClassLoader used by the underlying container. This could lead to remote code execution under certain conditions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1116665?
The severity of REDHAT-BUG-1116665 is considered critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-1116665?
To fix REDHAT-BUG-1116665, upgrade to a patched version of Apache commons-beanutils that restricts access to the class property.
What versions of Apache commons-beanutils are affected by REDHAT-BUG-1116665?
All versions of Apache commons-beanutils prior to the patched release are affected by REDHAT-BUG-1116665.
Can REDHAT-BUG-1116665 be exploited remotely?
Yes, REDHAT-BUG-1116665 can be exploited by a remote attacker if the framework built on commons-beanutils does not suppress access to the class property.
Is there a workaround for REDHAT-BUG-1116665?
A possible workaround for REDHAT-BUG-1116665 is to configure the application to limit access to the class properties directly.