CVE-2019-10086 (CNNVD-201908-1140)

HIGH
中文标题:
Apache Commons Beanutils 代码问题漏洞
英文标题:
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressi...
CVSS分数: 7.3
发布时间: 2019-08-20 20:10:15
漏洞类型: 代码问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Apache Commons Beanutils是美国阿帕奇（Apache）基金会的一款提供可操作JavaBean的工具类的软件包。 Apache Commons Beanutils 1.9.2版本中存在代码问题漏洞。攻击者可利用该漏洞执行任意代码/命令。

英文描述:

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CWE类型:
CWE-502
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
Apache Apache Commons Beanutils Apache Commons Beanutils 1.0 to 1.9.3 - - cpe:2.3:a:apache:apache_commons_beanutils:apache_commons_beanutils_1.0_to_1.9.3:*:*:*:*:*:*:*
apache commons_beanutils * - - cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:*
apache nifi 1.14.0 - - cpe:2.3:a:apache:nifi:1.14.0:*:*:*:*:*:*:*
apache nifi 1.15.0 - - cpe:2.3:a:apache:nifi:1.15.0:*:*:*:*:*:*:*
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
opensuse leap 15.0 - - cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
opensuse leap 15.1 - - cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
fedoraproject fedora 30 - - cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
fedoraproject fedora 31 - - cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 - - cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
redhat jboss_enterprise_application_platform 7.2.0 - - cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
oracle agile_plm 9.3.3 - - cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
oracle agile_plm 9.3.5 - - cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
oracle agile_plm 9.3.6 - - cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
oracle agile_product_lifecycle_management_integration_pack 3.5 - - cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.5:*:*:*:*:e-business_suite:*:*
oracle agile_product_lifecycle_management_integration_pack 3.6 - - cpe:2.3:a:oracle:agile_product_lifecycle_management_integration_pack:3.6:*:*:*:*:e-business_suite:*:*
oracle application_testing_suite 13.3.0.1 - - cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
oracle banking_platform 2.4.0 - - cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
oracle banking_platform 2.7.1 - - cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
oracle banking_platform 2.9.0 - - cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
oracle blockchain_platform * - - cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management 7.5 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management 12.0.0.3.0 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management_elastic_charging_engine 11.3.0.9 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management_elastic_charging_engine 12.0.0.3 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
oracle communications_cloud_native_core_console 1.4.0 - - cpe:2.3:a:oracle:communications_cloud_native_core_console:1.4.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_policy 1.9.0 - - cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.9.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_unified_data_repository 1.6.0 - - cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.6.0:*:*:*:*:*:*:*
oracle communications_convergence 3.0.2.2.0 - - cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*
oracle communications_design_studio 7.3.4 - - cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:*
oracle communications_design_studio 7.3.5 - - cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:*
oracle communications_design_studio 7.4.0 - - cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:*
oracle communications_evolved_communications_application_server 7.1 - - cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
oracle communications_metasolv_solution 6.3.0 - - cpe:2.3:a:oracle:communications_metasolv_solution:6.3.0:*:*:*:*:*:*:*
oracle communications_metasolv_solution 6.3.1 - - cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:*
oracle communications_network_integrity 7.3.6 - - cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*
oracle communications_performance_intelligence_center 10.4.0.3 - - cpe:2.3:a:oracle:communications_performance_intelligence_center:10.4.0.3:*:*:*:*:*:*:*
oracle communications_pricing_design_center 12.0.0.3.0 - - cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
oracle communications_unified_inventory_management 7.3.4 - - cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*
oracle communications_unified_inventory_management 7.3.5 - - cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*
oracle communications_unified_inventory_management 7.4.0 - - cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
oracle communications_unified_inventory_management 7.4.1 - - cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
oracle customer_management_and_segmentation_foundation 18.0 - - cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
oracle enterprise_manager_for_virtualization 13.4.0.0 - - cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.4.0.0:*:*:*:*:*:*:*
oracle financial_services_revenue_management_and_billing_analytics 2.7 - - cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*
oracle financial_services_revenue_management_and_billing_analytics 2.8 - - cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.0.0 - - cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
oracle flexcube_private_banking 12.1.0 - - cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
oracle fusion_middleware 11.1.1.9 - - cpe:2.3:a:oracle:fusion_middleware:11.1.1.9:*:*:*:*:*:*:*
oracle fusion_middleware 12.2.1.3.0 - - cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:*
oracle fusion_middleware 12.2.1.4.0 - - cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*
oracle healthcare_foundation 7.1.5 - - cpe:2.3:a:oracle:healthcare_foundation:7.1.5:*:*:*:*:*:*:*
oracle healthcare_foundation 7.2.2 - - cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:*
oracle healthcare_foundation 7.3.0 - - cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*
oracle healthcare_foundation 7.3.1 - - cpe:2.3:a:oracle:healthcare_foundation:7.3.1:*:*:*:*:*:*:*
oracle healthcare_foundation 8.0.1 - - cpe:2.3:a:oracle:healthcare_foundation:8.0.1:*:*:*:*:*:*:*
oracle hospitality_opera_5 5.5 - - cpe:2.3:a:oracle:hospitality_opera_5:5.5:*:*:*:*:*:*:*
oracle hospitality_opera_5 5.6 - - cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*
oracle hospitality_reporting_and_analytics 9.1.0 - - cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*
oracle insurance_data_gateway 1.0.2.3 - - cpe:2.3:a:oracle:insurance_data_gateway:1.0.2.3:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_orchestrator * - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_orchestrator 9.2.5.3 - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.5.3:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_tools * - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
oracle jd_edwards_enterpriseone_tools 9.2.5.3 - - cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.5.3:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.56 - - cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.57 - - cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_pt_peopletools 8.56 - - cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_pt_peopletools 8.57 - - cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_pt_peopletools 8.58 - - cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*
oracle primavera_gateway * - - cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
oracle real-time_decisions_solutions 3.2.0.0 - - cpe:2.3:a:oracle:real-time_decisions_solutions:3.2.0.0:*:*:*:*:*:*:*
oracle retail_advanced_inventory_planning 14.1 - - cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*
oracle retail_back_office 14.1 - - cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
oracle retail_central_office 14.1 - - cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
oracle retail_invoice_matching 16.0.3 - - cpe:2.3:a:oracle:retail_invoice_matching:16.0.3:*:*:*:*:*:*:*
oracle retail_merchandising_system 5.0.3.1 - - cpe:2.3:a:oracle:retail_merchandising_system:5.0.3.1:*:*:*:*:*:*:*
oracle retail_point-of-service 14.1 - - cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
oracle retail_predictive_application_server 16.0 - - cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*
oracle retail_price_management 14.0 - - cpe:2.3:a:oracle:retail_price_management:14.0:*:*:*:*:*:*:*
oracle retail_price_management 14.0.1 - - cpe:2.3:a:oracle:retail_price_management:14.0.1:*:*:*:*:*:*:*
oracle retail_price_management 15.0 - - cpe:2.3:a:oracle:retail_price_management:15.0:*:*:*:*:*:*:*
oracle retail_price_management 16.0 - - cpe:2.3:a:oracle:retail_price_management:16.0:*:*:*:*:*:*:*
oracle retail_returns_management 14.1 - - cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 7.1 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 15.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 16.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 17.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
oracle retail_xstore_point_of_service 18.0 - - cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*
oracle service_bus 11.1.1.9.0 - - cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:*
oracle service_bus 12.2.1.3.0 - - cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*
oracle service_bus 12.2.1.4.0 - - cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*
oracle solaris_cluster 4.4 - - cpe:2.3:a:oracle:solaris_cluster:4.4:*:*:*:*:*:*:*
oracle time_and_labor * - - cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*
oracle utilities_framework * - - cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*
oracle utilities_framework 4.2.0.2.0 - - cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*
oracle utilities_framework 4.2.0.3.0 - - cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*
oracle utilities_framework 4.4.0.0.0 - - cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
oracle utilities_framework 4.4.0.2.0 - - cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
oracle utilities_framework 4.4.0.3.0 - - cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*
oracle weblogic_server 10.3.6.0.0 - - cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
[www-announce] 20190815 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. mailing-list
cve.org
访问
[debian-lts-announce] 20190824 [SECURITY] [DLA 1896-1] commons-beanutils security update mailing-list
cve.org
访问
[tinkerpop-commits] 20190829 [tinkerpop] branch master updated: Bump commons-beanutils to 1.9.4 for CVE-2019-10086 - CTR mailing-list
cve.org
访问
openSUSE-SU-2019:2058 vendor-advisory
cve.org
访问
[commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. mailing-list
cve.org
访问
[commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. mailing-list
cve.org
访问
[commons-issues] 20190925 [GitHub] [commons-validator] jeff-schram opened a new pull request #18: Update pom.xml mailing-list
cve.org
访问
[shiro-dev] 20191001 [jira] [Updated] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix mailing-list
cve.org
访问
[shiro-dev] 20191001 [jira] [Created] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fiix mailing-list
cve.org
访问
[shiro-dev] 20191001 [jira] [Commented] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix mailing-list
cve.org
访问
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org
访问
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org
访问
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org
访问
[shiro-dev] 20191023 [jira] [Assigned] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix mailing-list
cve.org
访问
[shiro-dev] 20191105 [jira] [Resolved] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix mailing-list
cve.org
访问
FEDORA-2019-bcad44b5d6 vendor-advisory
cve.org
访问
FEDORA-2019-79b5790566 vendor-advisory
cve.org
访问
RHSA-2019:4317 vendor-advisory
cve.org
访问
RHSA-2020:0057 vendor-advisory
cve.org
访问
RHSA-2020:0194 vendor-advisory
cve.org
访问
RHSA-2020:0806 vendor-advisory
cve.org
访问
RHSA-2020:0811 vendor-advisory
cve.org
访问
RHSA-2020:0804 vendor-advisory
cve.org
访问
RHSA-2020:0805 vendor-advisory
cve.org
访问
[brooklyn-dev] 20200420 [GitHub] [brooklyn-server] duncangrant opened a new pull request #1091: Update library versions due to CVEs mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[atlas-dev] 20201022 [jira] [Created] (ATLAS-4002) Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201022 Re: Review Request 72983: ATLAS-4002 : Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201023 Re: Review Request 72983: ATLAS-4002 : Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201023 [jira] [Updated] (ATLAS-4002) Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-commits] 20201023 [atlas] 01/05: ATLAS-4002 : Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201023 [jira] [Commented] (ATLAS-4002) Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201026 [jira] [Updated] (ATLAS-4002) Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[atlas-dev] 20201023 [jira] [Commented] (ATLAS-4002) Upgrade commons-beanutils to 1.9.4 due to CVE-2019-10086 mailing-list
cve.org
访问
[rocketmq-dev] 20201223 [GitHub] [rocketmq] crazywen opened a new pull request #2515: Update pom.xml mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[dolphinscheduler-commits] 20210121 [GitHub] [incubator-dolphinscheduler] lgcareer commented on pull request #4525: [Improvement-4506][LICENSE] upgrade the version of the commons-beanutils mailing-list
cve.org
访问
[dolphinscheduler-commits] 20210121 [GitHub] [incubator-dolphinscheduler] c-f-cooper commented on pull request #4525: [Improvement-4506][LICENSE] upgrade the version of the commons-beanutils mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[nifi-issues] 20210827 [jira] [Updated] (NIFI-9170) Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210827 [GitHub] [nifi] naddym opened a new pull request #5351: NIFI-9170 Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210827 [jira] [Created] (NIFI-9170) Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210907 [GitHub] [nifi] MikeThomsen commented on pull request #5351: NIFI-9170 Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-commits] 20210907 [nifi] branch main updated: NIFI-9170 Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 NIFI-9170 Add two more 1.9.4 references to close out the few things identified by the Maven dependency plugin. mailing-list
cve.org
访问
[nifi-issues] 20210907 [GitHub] [nifi] asfgit closed pull request #5351: NIFI-9170 Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210907 [jira] [Commented] (NIFI-9170) Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210908 [GitHub] [nifi] naddym commented on pull request #5351: NIFI-9170 Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
[nifi-issues] 20210915 [jira] [Updated] (NIFI-9170) Upgrade commons-beanutils to 1.9.4 to mitigate CVE-2019-10086 mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
CVSS评分详情
7.3
HIGH
CVSS向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS版本: 3.1
机密性
LOW
完整性
LOW
可用性
LOW
时间信息
发布时间:
2019-08-20 20:10:15
修改时间:
2024-08-04 22:10:09
创建时间:
2025-11-11 15:35:26
更新时间:
2025-11-11 15:54:44
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2019-10086 2025-11-11 15:19:57 2025-11-11 07:35:26
NVD nvd_CVE-2019-10086 2025-11-11 14:56:25 2025-11-11 07:43:59
CNNVD cnnvd_CNNVD-201908-1140 2025-11-11 15:10:15 2025-11-11 07:54:44
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:54:44
vulnerability_type: 未提取 → 代码问题; cnnvd_id: 未提取 → CNNVD-201908-1140; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 代码问题
  • cnnvd_id: 未提取 -> CNNVD-201908-1140
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:43:59
severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.3; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 1 → 105; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
  • cvss_score: 未提取 -> 7.3
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • cvss_version: NOT_EXTRACTED -> 3.1
  • affected_products_count: 1 -> 105
  • data_sources: ['cve'] -> ['cve', 'nvd']