Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 org.apache.commons getProperty access control

Summaryinfo

A vulnerability was found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1 and classified as critical. This impacts the function getProperty of the component org.apache.commons. The manipulation results in access control. This vulnerability is known as CVE-2025-48734. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1. Affected is the function getProperty of the component org.apache.commons. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

The advisory is shared for download at lists.apache.org. This vulnerability is traded as CVE-2025-48734 since 05/23/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/26/2026). The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 237781 (SUSE SLES15 / openSUSE 15 Security Update : apache-commons-beanutils (SUSE-SU-2025:01815-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.11.0 or 2.0.0-M2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (237781), EUVD (EUVD-2025-16219) and CERT Bund (WID-SEC-2025-1169). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• IBM Security Guardium
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Red Hat JBoss Enterprise Application Platform
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Operational Decision Manager
• IBM SPSS
• Gentoo Linux
• IBM QRadar SIEM
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM InfoSphere Information Server
• IBM Business Automation Workflow
• Apache Commons
• IBM Tivoli Business Service Manager
• Atlassian Bamboo
• Dell PowerProtect Data Domain
• IBM Tivoli Network Manager
• Atlassian Confluence
• Red Hat JBoss A-MQ
• SAS Institute Base SAS
• Atlassian Bitbucket

Productinfo

Vendor

• Apache

Name

• Commons BeanUtils

Version

• 1
• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 2.0.0-

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion