commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

🗓️ 25 Sep 2025 00:09:06Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 5 Views

BeanUtils exposes enum declaredClass by default, enabling code execution via property paths.

Reporter	Title	Published	Views	Family All 337
ibm	Security Bulletin: IBM Event Streams is vulnerable to improper access control	4 Mar 202610:31	–	ibm
ibm	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	9 Mar 202610:35	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	24 Oct 202517:27	–	ibm
ibm	Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to improper access control due to Apache Commons BeanUtils (CVE-2025-23184)	2 Jul 202515:26	–	ibm
ibm	Security Bulletin: IBM Datapower Operations Dashboard may allow remote attackers to access the ClassLoader and execute arbitrary code CVE-2025-48734	19 Mar 202613:24	–	ibm
ibm	Security Bulletin: IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities	9 Feb 202615:27	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:40	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics	27 Jun 202520:52	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
ibm	Security Bulletin: IBM Jazz Reporting Service is affected by improper access control due to Apache Commons	1 Dec 202506:29	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	eap7-apache-commons-beanutils	1.11.0-1.redhat_00001.1.ep7.el7	eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hibernate-validator	5.3.6-1.SP1_redhat_00001.1.ep7.el7	eap7-hibernate-validator-5.3.6-1.SP1_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hibernate-validator-cdi	5.3.6-1.SP1_redhat_00001.1.ep7.el7	eap7-hibernate-validator-cdi-5.3.6-1.SP1_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hornetq	2.4.11-1.Final_redhat_00001.1.ep7.el7	eap7-hornetq-2.4.11-1.Final_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hornetq-commons	2.4.11-1.Final_redhat_00001.1.ep7.el7	eap7-hornetq-commons-2.4.11-1.Final_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hornetq-core-client	2.4.11-1.Final_redhat_00001.1.ep7.el7	eap7-hornetq-core-client-2.4.11-1.Final_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-hornetq-jms-client	2.4.11-1.Final_redhat_00001.1.ep7.el7	eap7-hornetq-jms-client-2.4.11-1.Final_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-undertow	1.4.18-17.SP15_redhat_00001.1.ep7.el7	eap7-undertow-1.4.18-17.SP15_redhat_00001.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-wildfly	7.1.12-2.GA_redhat_00002.1.ep7.el7	eap7-wildfly-7.1.12-2.GA_redhat_00002.1.ep7.el7.noarch.rpm
Red Hat Enterprise Linux	7	noarch	eap7-wildfly-modules	7.1.12-2.GA_redhat_00002.1.ep7.el7	eap7-wildfly-modules-7.1.12-2.GA_redhat_00002.1.ep7.el7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-48734
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-wxr5-93ph-8wr9
github	www.github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc
lists	www.lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-48734
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2025/05/28/6

08 Jul 2026 08:58Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

EPSS0.01548

SSVC

beanutils enum declaredClass remote code execution external property paths