CVE-2019-10086 Apache Commons Beanutils
| Affected software | Apache Commons Beanutils |
|---|---|
| Severity | 7.3 High CVSS 3.1 2 scores |
| Fixed in | 1.9.4 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 20 Aug 2019 |
| Updated | 8 Oct 2026 |
Description
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 29% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2019-10086.armr patch rule, ARMR 2.6 added 2022-10-04 updated 2026-03-04How to mitigate CVE-2019-10086
Upgrade Apache Commons Beanutils to 1.9.4 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.3 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
2 metrics
CVSS
7.3 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Communications / Security (Apache Commons BeanUtils) (46.6.4, 46.6.5) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Hyperion / Security (Apache Commons BeanUtils) (11.2.14.0.000) Oracle Hyperion / Security (Apache Commons BeanUtils) (11.2.14.0.000) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Analytics / BI Platform Security (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / ADF UCM Application (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Apache Commons BeanUtils) (12.2.1.4.0) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Analytics / Presentation Services (Apache Commons BeanUtils) (6.4.0.0.0, 7.0.0.0.0, 12.2.1.4.0) Oracle Analytics / Service Administration UI (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Commerce / Experience Manager, Platform Services (Apache Commons BeanUtils) (11.3.2) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Analytics / Analytics Server (Apache Commons BeanUtils) (6.4.0.0.0) Oracle Insurance Applications / Logger (Apache Commons BeanUtils) (1.0.1.8) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle E-Business Suite / Common Modules (Apache Commons BeanUtils) (12.2.3-12.2.11) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Health Sciences Applications / User Interface (Apache Commons BeanUtils) (2.5.2.1, 3.0.0.0) Oracle Retail Applications / General (Apache Commons BeanUtils) (15.0.3.1, 16.0.3) Oracle Retail Applications / others (Apache Commons BeanUtils) (16.0.3) Oracle Supply Chain / Installation Issues (Apache Commons BeanUtils) (3.6.1) Oracle Supply Chain / Installation Issues (Apache Commons BeanUtils) (6.2.1.0) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Blockchain Platform / BCS Console (Apache Commons BeanUtils) (Prior to 21.1.2) Oracle Communications Applications / User Interface (Apache Commons BeanUtils) (7.3.6) Oracle Retail Applications / Security (Apache Commons BeanUtils) (16.0.3) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications Applications / Inventory (Apache Commons BeanUtils) (7.3.4, 7.3.5, 7.4.0) Oracle Communications Applications / Message Store (Apache Commons BeanUtils) (3.0.2.2.0) Oracle E-Business Suite / Timecard (Apache Commons Beanutils) (12.2.6-12.2.11) Oracle Food and Beverage Applications / Reporting (Apache Commons BeanUtils) (9.1.0) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / Policy (Apache Commons BeanUtils) (12.5.0) Oracle Communications Applications / Billing Care (Apache Commons BeanUtils) (7.5.0.0.0, 12.0.0.3.0) Oracle Insurance Applications / Architecture (Apache Commons BeanUtils) (11.0.0 - 11.3.1) Oracle Insurance Applications / Development tools (Apache Commons BeanUtils) (12.6.0 - 12.6.4) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Communications / Managing and Using Subscriber Data (Apache Commons BeanUtils) (7.1) Oracle Communications / Measurements (Apache Commons BeanUtils) (1.6.0) Oracle Communications / Measurements (Apache Commons BeanUtils) (1.9.0) Oracle Communications / Signaling (Apache Commons BeanUtils) (1.4.0) Oracle Communications Applications / Transformation for PDC (Apache Commons BeanUtils) (12.0.0.3.0) Oracle Enterprise Manager / Load Testing for Web Apps (Apache Commons BeanUtils) (13.3.0.1) Oracle Financial Services Applications / Dashboards (Apache Commons BeanUtils) (2.7.0, 2.8.0) Oracle Fusion Middleware / WLS Deployment Template for RT (Apache Commons BeanUtils) (3.2.0.0) Oracle Retail Applications / Foundation (Apache Commons BeanUtils) (15.0.3.1) Oracle Retail Applications / Manage Allocation (Apache Commons BeanUtils) (14.0, 14.1, 15.0, 16.0) Oracle Systems / Application Integration (Apache Commons BeanUtils) (4.4) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Communications / PMAC (Apache Commons BeanUtils) (10.4.0.3) Oracle Communications Applications / Inventory Group (Apache Commons BeanUtils) (7.3.4, 7.3.5, 7.4.0, 7.4.1) Oracle Enterprise Manager / Administration operations (Apache Commons BeanUtils) (13.4.0.0) Oracle Financial Services Applications / Collections (Apache Commons BeanUtils) (2.4.0, 2.7.1, 2.9.0) Oracle Financial Services Applications / Loans and Pledges (Apache Commons BeanUtils) (12.0.0, 12.1.0) Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Commons BeanUtils) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Core (Apache Commons BeanUtils) (10.3.6.0.0) Oracle Fusion Middleware / Web Container (Apache Commons BeanUtils) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Health Sciences Applications / Self Service Analytics (Apache Commons BeanUtils) (7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1) Oracle Hospitality Applications / Integrations (Apache Commons Beanutils) (5.5, 5.6) Oracle Insurance Applications / Security (Apache Commons BeanUtils) (1.0.2.3) Oracle JD Edwards / E1 IOT Orchestrator Security (Apache Commons BeanUtils) (Prior to 9.2.5.3) Oracle JD Edwards / Portal SEC (Apache Commons BeanUtils) (Prior to 9.2.5.3) Oracle PeopleSoft / Weblogic (Apache Commons BeanUtils) (8.56, 8.57, 8.58) Oracle Retail Applications / Commerce Anywhere (Apache Commons BeanUtils) (14.1) Oracle Retail Applications / Main Dashboard (Apache Commons BeanUtils) (14.1) Oracle Retail Applications / Operations & Maintenance (Apache Commons BeanUtils) (14.1) Oracle Retail Applications / Pricing (Apache Commons BeanUtils) (14.1) Oracle Retail Applications / Pricing (Apache Commons BeanUtils) (14.1) Oracle Retail Applications / RPAS Fusion Client (Apache Commons BeanUtils) (16.0) Oracle Supply Chain / Core (Apache Commons BeanUtils) (3.5, 3.6) Oracle Supply Chain / Installer (Apache Commons BeanUtils) (3.5, 3.6) Oracle Supply Chain / Security (Apache Commons BeanUtils) (9.3.3, 9.3.5, 9.3.6) Oracle Utilities Applications / General (Apache Commons BeanUtils) (4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Communications / IDIH (Apache Commons BeanUtils) (8.0.0-8.2.2) Oracle Communications / Management (Apache Commons BeanUtils) (9.0) Oracle Communications Applications / Coherence Query (Apache Commons BeanUtils) (11.3.0.9, 12.0.0.3) Oracle Communications Applications / Online Help (Apache Commons BeanUtils) (6.3.0-6.3.1) Oracle Construction and Engineering / Core (Apache Commons BeanUtils) (16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12) Oracle Financial Services Applications / Core (Apache Commons BeanUtils) (8.0.6) Oracle Financial Services Applications / Core (Apache Commons BeanUtils) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / Core (Apache Commons BeanUtils) (8.0.6, 8.0.7, 8.1.0) Oracle Financial Services Applications / Core (Apache Commons BeanUtils) (8.0.7, 8.1.0) Oracle Financial Services Applications / Core (Apache Commons BeanUtils) (8.1.0) Oracle Financial Services Applications / Infrastructure (Apache Commons BeanUtils) (8.0.6-8.1.0) Oracle Fusion Middleware / Console (Apache Commons Beanutils) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Install (Apache Commons BeanUtils) (12.2.1.3.0) Oracle Fusion Middleware / Install, config, upgrade (Apache Commons BeanUtils) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle Fusion Middleware / Integrator ETL (Apache Commons BeanUtils) (3.2.0.0) Oracle Fusion Middleware / Platform Installation (Apache Commons BeanUtils) (3.2.1.0) Oracle Fusion Middleware / Security Framework (Apache Commons BeanUtils) (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0) Oracle MySQL / Service Manager (Apache Commons BeanUtils) (8.0.22 and prior) Oracle Retail Applications / PeopleSoft Integration (Apache Commons BeanUtils) (14.1.3, 15.0.3, 16.0.3) Oracle Retail Applications / RIB Kernal (Apache Commons BeanUtils) (14.1.3, 15.0.3, 16.0.3) Oracle Retail Applications / RSB kernel (Apache Commons BeanUtils) (14.1.3, 15.0.3, 16.0.3) Oracle Retail Applications / System Administration (Apache Commons BeanUtils) (15.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Database Server / Spatial Studio (Apache Commons Beanutils) (Spatial Studio: Prior to 19.2.1) Oracle's note: The CVE-2019-10086 is not exploitable in the context of Oracle Spatial Studio product, thus the CVSS score is 0.0. Oracle Retail Applications / Promotions (Apache Commons-Beanutils) (18.0) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Construction and Engineering / Admin (Apache Commons Beanutils) (16.2.0 - 16.2.11, 17.12.0 - 17.12.6) Oracle Retail Applications / Xenvironment (Apache Commons) (7.1, 15.0, 16.0, 17.0, 18.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Analytics Server (Apache Commons BeanUtils) | 6.4.0.0.0 | 6.4.0.0.0 |
| Oracle Analytics | BI Platform Security (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Analytics | Presentation Services (Apache Commons BeanUtils) | 6.4.0.0.0, 7.0.0.0.0, 12.2.1.4.0 | 6.4.0.0.0 · 7.0.0.0.0 · 12.2.1.4.0 |
| Oracle Analytics | Service Administration UI (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Blockchain Platform | BCS Console (Apache Commons BeanUtils) | Prior to 21.1.2 | |
| Oracle Commerce | Experience Manager, Platform Services (Apache Commons BeanUtils) | 11.3.2 | 11.3.2 |
| Oracle Communications | IDIH (Apache Commons BeanUtils) | 8.0.0-8.2.2 | |
| Oracle Communications | Management (Apache Commons BeanUtils) | 9.0 | 9.0 |
| Oracle Communications | Managing and Using Subscriber Data (Apache Commons BeanUtils) | 7.1 | 7.1 |
| Oracle Communications | Measurements (Apache Commons BeanUtils) | 1.6.0 | 1.6.0 · 1.9.0 |
| Oracle Communications | PMAC (Apache Commons BeanUtils) | 10.4.0.3 | 10.4.0.3 |
| Oracle Communications | Policy (Apache Commons BeanUtils) | 12.5.0 | 12.5.0 |
| Oracle Communications | Security (Apache Commons BeanUtils) | 46.6.4, 46.6.5 | 46.6.4 · 46.6.5 |
| Oracle Communications | Signaling (Apache Commons BeanUtils) | 1.4.0 | 1.4.0 |
| Oracle Communications Applications | Billing Care (Apache Commons BeanUtils) | 7.5.0.0.0, 12.0.0.3.0 | 7.5.0.0.0 · 12.0.0.3.0 |
| Oracle Communications Applications | Coherence Query (Apache Commons BeanUtils) | 11.3.0.9, 12.0.0.3 | 11.3.0.9 · 12.0.0.3 |
| Oracle Communications Applications | Inventory (Apache Commons BeanUtils) | 7.3.4, 7.3.5, 7.4.0 | 7.3.4 · 7.3.5 · 7.4.0 |
| Oracle Communications Applications | Inventory Group (Apache Commons BeanUtils) | 7.3.4, 7.3.5, 7.4.0, 7.4.1 | 7.3.4 · 7.3.5 · 7.4.0 · 7.4.1 |
| Oracle Communications Applications | Message Store (Apache Commons BeanUtils) | 3.0.2.2.0 | 3.0.2.2.0 |
| Oracle Communications Applications | Online Help (Apache Commons BeanUtils) | 6.3.0-6.3.1 | |
| Oracle Communications Applications | Transformation for PDC (Apache Commons BeanUtils) | 12.0.0.3.0 | 12.0.0.3.0 |
| Oracle Communications Applications | User Interface (Apache Commons BeanUtils) | 7.3.6 | 7.3.6 |
| Oracle Construction and Engineering | Admin (Apache Commons Beanutils) | 16.2.0 - 16.2.11, 17.12.0 - 17.12.6 | |
| Oracle Construction and Engineering | Core (Apache Commons BeanUtils) | 16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12 | 16.1 · 16.2 · 18.8 · 19.12 · 20.12 |
| Oracle Database Server | Spatial Studio (Apache Commons Beanutils) | Spatial Studio: Prior to 19.2.1 | |
| Oracle E-Business Suite | Common Modules (Apache Commons BeanUtils) | 12.2.3-12.2.11 | |
| Oracle E-Business Suite | Timecard (Apache Commons Beanutils) | 12.2.6-12.2.11 | |
| Oracle Enterprise Manager | Administration operations (Apache Commons BeanUtils) | 13.4.0.0 | 13.4.0.0 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache Commons BeanUtils) | 13.3.0.1 | 13.3.0.1 |
| Oracle Financial Services Applications | Collections (Apache Commons BeanUtils) | 2.4.0, 2.7.1, 2.9.0 | 2.4.0 · 2.7.1 · 2.9.0 |
| Oracle Financial Services Applications | Core (Apache Commons BeanUtils) | 8.0.6 | 8.0.6 · 8.0.7 · 8.1.0 |
| Oracle Financial Services Applications | Dashboards (Apache Commons BeanUtils) | 2.7.0, 2.8.0 | 2.7.0 · 2.8.0 |
| Oracle Financial Services Applications | Infrastructure (Apache Commons BeanUtils) | 8.0.6-8.1.0 | |
| Oracle Financial Services Applications | Loans and Pledges (Apache Commons BeanUtils) | 12.0.0, 12.1.0 | 12.0.0 · 12.1.0 |
| Oracle Food and Beverage Applications | Reporting (Apache Commons BeanUtils) | 9.1.0 | 9.1.0 |
| Oracle Fusion Middleware | ADF UCM Application (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (Apache Commons BeanUtils) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Console (Apache Commons Beanutils) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Core (Apache Commons BeanUtils) | 10.3.6.0.0 | 10.3.6.0.0 |
| Oracle Fusion Middleware | Install (Apache Commons BeanUtils) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | Install, config, upgrade (Apache Commons BeanUtils) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Integrator ETL (Apache Commons BeanUtils) | 3.2.0.0 | 3.2.0.0 |
| Oracle Fusion Middleware | Platform Installation (Apache Commons BeanUtils) | 3.2.1.0 | 3.2.1.0 |
| Oracle Fusion Middleware | Security Framework (Apache Commons BeanUtils) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | WLS Deployment Template for RT (Apache Commons BeanUtils) | 3.2.0.0 | 3.2.0.0 |
| Oracle Fusion Middleware | Web Container (Apache Commons BeanUtils) | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Health Sciences Applications | Self Service Analytics (Apache Commons BeanUtils) | 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1 | 7.1.5 · 7.2.2 · 7.3.0 · 7.3.1 · 8.0.1 |
| Oracle Health Sciences Applications | User Interface (Apache Commons BeanUtils) | 2.5.2.1, 3.0.0.0 | 2.5.2.1 · 3.0.0.0 |
| Oracle Hospitality Applications | Integrations (Apache Commons Beanutils) | 5.5, 5.6 | 5.5 · 5.6 |
| Oracle Hyperion | Security (Apache Commons BeanUtils) | 11.2.14.0.000 | 11.2.14.0.0 |
| Oracle Insurance Applications | Architecture (Apache Commons BeanUtils) | 11.0.0 - 11.3.1 | |
| Oracle Insurance Applications | Development tools (Apache Commons BeanUtils) | 12.6.0 - 12.6.4 | |
| Oracle Insurance Applications | Logger (Apache Commons BeanUtils) | 1.0.1.8 | 1.0.1.8 |
| Oracle Insurance Applications | Security (Apache Commons BeanUtils) | 1.0.2.3 | 1.0.2.3 |
| Oracle JD Edwards | E1 IOT Orchestrator Security (Apache Commons BeanUtils) | Prior to 9.2.5.3 | |
| Oracle JD Edwards | Portal SEC (Apache Commons BeanUtils) | Prior to 9.2.5.3 | |
| Oracle MySQL | Service Manager (Apache Commons BeanUtils) | 8.0.22 and prior | |
| Oracle PeopleSoft | Weblogic (Apache Commons BeanUtils) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
| Oracle Retail Applications | Commerce Anywhere (Apache Commons BeanUtils) | 14.1 | 14.1 |
| Oracle Retail Applications | Foundation (Apache Commons BeanUtils) | 15.0.3.1 | 15.0.3.1 |
| Oracle Retail Applications | General (Apache Commons BeanUtils) | 15.0.3.1, 16.0.3 | 15.0.3.1 · 16.0.3 |
| Oracle Retail Applications | Main Dashboard (Apache Commons BeanUtils) | 14.1 | 14.1 |
| Oracle Retail Applications | Manage Allocation (Apache Commons BeanUtils) | 14.0, 14.1, 15.0, 16.0 | 14.0 · 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | Operations & Maintenance (Apache Commons BeanUtils) | 14.1 | 14.1 |
| Oracle Retail Applications | PeopleSoft Integration (Apache Commons BeanUtils) | 14.1.3, 15.0.3, 16.0.3 | 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | Pricing (Apache Commons BeanUtils) | 14.1 | 14.1 |
| Oracle Retail Applications | Promotions (Apache Commons-Beanutils) | 18.0 | 18.0 |
| Oracle Retail Applications | RIB Kernal (Apache Commons BeanUtils) | 14.1.3, 15.0.3, 16.0.3 | 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | RPAS Fusion Client (Apache Commons BeanUtils) | 16.0 | 16.0 |
| Oracle Retail Applications | RSB kernel (Apache Commons BeanUtils) | 14.1.3, 15.0.3, 16.0.3 | 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | Security (Apache Commons BeanUtils) | 16.0.3 | 16.0.3 |
| Oracle Retail Applications | System Administration (Apache Commons BeanUtils) | 15.0 | 15.0 |
| Oracle Retail Applications | Xenvironment (Apache Commons) | 7.1, 15.0, 16.0, 17.0, 18.0 | 7.1 · 15.0 · 16.0 · 17.0 · 18.0 |
| Oracle Retail Applications | others (Apache Commons BeanUtils) | 16.0.3 | 16.0.3 |
| Oracle Supply Chain | Core (Apache Commons BeanUtils) | 3.5, 3.6 | 3.5 · 3.6 |
| Oracle Supply Chain | Installation Issues (Apache Commons BeanUtils) | 3.6.1 | 3.6.1 · 6.2.1.0 |
| Oracle Supply Chain | Installer (Apache Commons BeanUtils) | 3.5, 3.6 | 3.5 · 3.6 |
| Oracle Supply Chain | Security (Apache Commons BeanUtils) | 9.3.3, 9.3.5, 9.3.6 | 9.3.3 · 9.3.5 · 9.3.6 |
| Oracle Systems | Application Integration (Apache Commons BeanUtils) | 4.4 | 4.4 |
| Oracle Utilities Applications | General (Apache Commons BeanUtils) | 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | 4.2.0.2.0 · 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
commons-beanutils:commons-beanutils |
0 | 1.9.4 |
unbounded |
Products and versions
61 products, 106 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | commons beanutils | generic | ≥ 1.0 and ≤ 1.9.3 |
| nvd | apache | nifi | generic | 1.14.0 · 1.15.0 |
| osv | commons-beanutils | commons-beanutils | generic | ＜ 1.9.4 |
| nvd | debian | debian linux | generic | 8.0 |
| nvd | fedoraproject | fedora | generic | 30 · 31 |
| nvd | opensuse | leap | generic | 15.0 · 15.1 |
| nvd | oracle | agile product lifecycle management | generic | 9.3.3 · 9.3.5 · 9.3.6 |
| nvd | oracle | agile product lifecycle management integration pack | generic | 3.5 · 3.6 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | banking platform | generic | 2.4.0 · 2.7.1 · 2.9.0 |
| nvd | oracle | blockchain platform | generic | ＜ 21.1.2 |
| nvd | oracle | communications billing and revenue management | generic | 7.5 · 12.0.0.3.0 |
| nvd | oracle | communications billing and revenue management elastic charging engine | generic | 11.3.0.9 · 12.0.0.3 |
| nvd | oracle | communications cloud native core console | generic | 1.4.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.9.0 |
| nvd | oracle | communications cloud native core unified data repository | generic | 1.6.0 |
| nvd | oracle | communications convergence | generic | 3.0.2.2.0 |
| nvd | oracle | communications design studio | generic | 7.3.4 · 7.3.5 · 7.4.0 |
| nvd | oracle | communications evolved communications application server | generic | 7.1 |
| nvd | oracle | communications metasolv solution | generic | 6.3.0 · 6.3.1 |
| nvd | oracle | communications network integrity | generic | 7.3.6 |
| nvd | oracle | communications performance intelligence center | generic | 10.4.0.3 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.3.0 |
| nvd | oracle | communications unified inventory management | generic | 7.3.4 · 7.3.5 · 7.4.0 · 7.4.1 |
| nvd | oracle | customer management and segmentation foundation | generic | 18.0 |
| nvd | oracle | enterprise manager for virtualization | generic | 13.4.0.0 |
| nvd | oracle | financial services revenue management and billing analytics | generic | 2.7 · 2.8 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | fusion middleware | generic | 11.1.1.9 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | healthcare foundation | generic | 7.1.5 · 7.2.2 · 7.3.0 · 7.3.1 · 8.0.1 |
| nvd | oracle | hospitality opera 5 | generic | 5.5 · 5.6 |
| nvd | oracle | hospitality reporting and analytics | generic | 9.1.0 |
| nvd | oracle | insurance data gateway | generic | 1.0.2.3 |
| nvd | oracle | jd edwards enterpriseone orchestrator | generic | 9.2.5.3 · ＜ 9.2.5.3 |
| nvd | oracle | jd edwards enterpriseone tools | generic | 9.2.5.3 · ＜ 9.2.5.3 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.56 · 8.57 |
| nvd | oracle | peoplesoft enterprise pt peopletools | generic | 8.56 · 8.57 · 8.58 |
| nvd | oracle | primavera gateway | generic | ≥ 16.2.0 and ≤ 16.2.11 · ≥ 17.12.0 and ≤ 17.12.6 |
| nvd | oracle | real-time decisions solutions | generic | 3.2.0.0 |
| nvd | oracle | retail advanced inventory planning | generic | 14.1 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail invoice matching | generic | 16.0.3 |
| nvd | oracle | retail merchandising system | generic | 5.0.3.1 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail predictive application server | generic | 16.0 |
| nvd | oracle | retail price management | generic | 14.0 · 14.0.1 · 15.0 · 16.0 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | retail xstore point of service | generic | 7.1 · 15.0 · 16.0 · 17.0 · 18.0 |
| nvd | oracle | service bus | generic | 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | solaris cluster | generic | 4.4 |
| nvd | oracle | time and labor | generic | ≥ 12.2.6 and ≤ 12.2.11 |
| nvd | oracle | utilities framework | generic | 4.2.0.2.0 · 4.2.0.3.0 · ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 |
| nvd | redhat | enterprise linux desktop | generic | 7.0 |
| nvd | redhat | enterprise linux eus | generic | 7.7 |
| nvd | redhat | enterprise linux server | generic | 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.7 |
| nvd | redhat | enterprise linux server tus | generic | 7.7 |
| nvd | redhat | enterprise linux workstation | generic | 7.0 |
| nvd | redhat | jboss enterprise application platform | generic | 7.2.0 |
References
Timeline
Timeline
| Published | 2019-08-20 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2022-10-04 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |