Security Bulletin: WebSphere Application Server is vulnerable to Apache Commons Beanutils in IBM Cloud (CVE-2019-10086)

Summary

There is a vulnerability in Apache Commons Beanutils that is used by WebSphere Application Server in IBM Cloud.

Vulnerability Details

CVEID:CVE-2019-10086
**DESCRIPTION:**In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166353 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

This vulnerability affect the following versions and releases of WebSphere Application Server and bundling products.

• 9.0
• 8.5

Remediation/Fixes

To patch new and existing service instances, refer to the IBM WebSphere Application Server bulletin listed below

• WebSphere Application Server is vulnerable to Apache Commons Beanutils (CVE-2019-10086)

Workarounds and Mitigations

None