Apache Commons BeanUtils vulnerabilities

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. However, this was not used by default by PropertyUtilsBean.

Apache Commons BeanUtils version 1.8.0 and in other products requiring commons-beanutils up to version 1.9.2 does not suppress the class property, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code.

Improper Access Control vulnerability in Apache Commons BeanUtils. If an application passes property paths from an external source directly to PropertyUtilsBean.getProperty() or getNestedProperty(), an attacker can access the 'declaredClass' property of enum objects, gaining access to the ClassLoader and executing arbitrary code.