commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

🗓️ 15 Sep 2025 14:44:30Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 6 Views

A flaw in Apache Commons BeanUtils allows code execution via an enum declaredClass property when using property access.

Reporter	Title	Published	Views	Family All 337
ibm	Security Bulletin: IBM Event Streams is vulnerable to improper access control	4 Mar 202610:31	–	ibm
ibm	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	9 Mar 202610:35	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	24 Oct 202517:27	–	ibm
ibm	Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to improper access control due to Apache Commons BeanUtils (CVE-2025-23184)	2 Jul 202515:26	–	ibm
ibm	Security Bulletin: IBM Datapower Operations Dashboard may allow remote attackers to access the ClassLoader and execute arbitrary code CVE-2025-48734	19 Mar 202613:24	–	ibm
ibm	Security Bulletin: IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities	9 Feb 202615:27	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:40	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics	27 Jun 202520:52	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
ibm	Security Bulletin: IBM Jazz Reporting Service is affected by improper access control due to Apache Commons	1 Dec 202506:29	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.516.2.1756902453-3.el8	jenkins-2.516.2.1756902453-3.el8.noarch.rpm
Red Hat Enterprise Linux	8	noarch	jenkins-2-plugins	4.12.1756902839-1.el8	jenkins-2-plugins-4.12.1756902839-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-48734
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-wxr5-93ph-8wr9
github	www.github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc
lists	www.lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-48734
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2025/05/28/6

30 Jun 2026 03:08Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

EPSS0.01548

SSVC

Apache Commons BeanUtils enum declaredClass property property access