Skip to content
Fencer Vulns
high 8.8

CVE-2025-48734 json

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

published 2025-05-28 17 mo ago modified 2026-11-03 5 d ago also EUVD-2025-16219 , GHSA-wxr5-93ph-8wr9

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Patch / fix

  • maven commons-beanutils:commons-beanutils 1.11.0
  • maven org.apache.commons:commons-beanutils2 2.0.0-M2
  • Apache Software Foundation Apache Commons BeanUtils 1.x 1.11.0
  • Apache Software Foundation Apache Commons BeanUtils 2.x 2.0.0-M2
  • commons-beanutils Debian 12 1.9.4-1+deb12u1
  • commons-beanutils Debian 14, Debian 13 1.10.1-1.1

debian advisories DEBIAN-CVE-2025-48734

  • commons-beanutils Ubuntu 22.04 LTS 1.9.4-1+deb11u1build0.22.04.1
  • commons-beanutils Ubuntu Pro 14.04 LTS 1.9.1-1ubuntu0.1~esm2
  • commons-beanutils Ubuntu Pro 18.04 LTS 1.9.3-1ubuntu0.1~esm2
  • commons-beanutils Ubuntu Pro 20.04 LTS 1.9.4-1ubuntu0.20.04.1~esm1
  • commons-beanutils Ubuntu Pro 24.04 LTS 1.9.4-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-48734

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-apache-commons-beanutils jboss enterprise application platform 7.4, jboss enterprise application platform eus 7.3 1.11.0-1.redhat_00001.1.el7eap
  • jenkins ocp tools 4.15 2.516.2.1756738247-3.el8
  • jenkins-2-plugins ocp tools 4.15 4.15.1756735456-1.el8
  • jenkins ocp tools 4.13 2.516.2.1756902120-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1756901992-1.el8
  • jenkins ocp tools 4.14 2.516.2.1757087588-3.el8
  • jenkins-2-plugins ocp tools 4.14 4.14.1757087858-1.el8
  • jenkins ocp tools 4.12 2.516.2.1756902453-3.el8

red hat advisories RHSA-2025:16668RHSA-2025:16667RHSA-2025:15817RHSA-2025:15815RHSA-2025:15816RHSA-2025:15813

  • apache-commons-beanutils SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 1.11.0-150200.3.9.1
  • apache-commons-beanutils SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.11.0-7.3.1

suse advisories SUSE-SU-2025:02056-1SUSE-SU-2025:01815-1

  • apache-commons-beanutils openSUSE Tumbleweed 1.11.0-1.1

opensuse advisories openSUSE-SU-2025:15175-1

  • ant AlmaLinux 8 1.10.5-1.module_el8.0.0+6004+2fc32706
  • bsf AlmaLinux 8 2.4.0-30.module_el8.0.0+6004+2fc32706
  • bsh AlmaLinux 8 2.0-13.b6.module_el8.0.0+6004+2fc32706
  • bcel AlmaLinux 8 6.2-2.module_el8.0.0+6004+2fc32706
  • jdom AlmaLinux 8 1.1.3-17.module_el8.0.0+6004+2fc32706
  • jsch AlmaLinux 8 0.1.54-6.module_el8.0.0+6004+2fc32706
  • qdox AlmaLinux 8 2.0-3.M9.module_el8.0.0+6004+2fc32706
  • xmvn AlmaLinux 8 3.0.0-21.module_el8.0.0+6004+2fc32706

almalinux advisories ALSA-2025:9318ALSA-2025:9166ALSA-2025:9114

  • apache-commons-beanutils Rocky Linux 9 1.9.4-10.el9_6
  • apache-commons-beanutils Rocky Linux 10 1.9.4-21.el10_0
  • ant Rocky Linux 8 1.10.5-1.module+el8.3.0+74+855e3f5d
  • ant Rocky Linux 8 1.10.5-1.module+el8.10.0+2003+8aeac9cb
  • bsf Rocky Linux 8 2.4.0-30.module+el8.3.0+74+855e3f5d
  • bsh Rocky Linux 8 2.0-13.b6.module+el8.3.0+74+855e3f5d
  • bcel Rocky Linux 8 6.2-2.module+el8.3.0+74+855e3f5d
  • jdom Rocky Linux 8 1.1.3-17.module+el8.3.0+74+855e3f5d

rocky linux advisories RLSA-2025:9114RLSA-2025:9166RLSA-2025:9318

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-48734 updated cvss 8.8

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  • Red Hat A-MQ Clients 2 commons-beanutils, commons-beanutils-core Red Hat AMQ Clients commons-beanutils
    affected: no fix planned “Will not fix”
  • Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-cxf-bom, quarkus-camel-bom Red Hat build of Apicurio Registry 2 commons-beanutils Red Hat build of Apicurio Registry 3 commons-beanutils
    affected: no fix available
  • Red Hat build of Debezium 2 commons-beanutils, commons-beanutils-core Red Hat build of Debezium 3 commons-beanutils, commons-beanutils-core Red Hat build of OptaPlanner 8 commons-beanutils Red Hat Data Grid 8 commons-beanutils, commons-beanutils-core
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 sat4j, qpid-cpp, qpid-qmf, ruby-qpid-qmf, python-qpid-qmf, qpid-cpp-client, +10 more Red Hat Enterprise Linux 7 xbean, xbean-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 commons-beanutils, commons-beanutils-core Red Hat Integration Camel K 1 commons-beanutils, commons-beanutils-core
    affected: no fix planned “Will not fix”
  • Red Hat Process Automation 7 commons-beanutils, commons-beanutils-core
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat streams for Apache Kafka commons-beanutils, commons-beanutils-core
    affected: no fix available
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.1-2, cryostat/cryostat-db-rhel9 4.0.1-4, cryostat/jfr-datasource-rhel9 4.0.1-2, cryostat/cryostat-reports-rhel9 4.0.1-2, cryostat/cryostat-storage-rhel9 4.0.1-4, cryostat/cryostat-rhel9-operator 4.0.1-4, +5 more
    fixed: vendor fix RHSA-2025:8265
show 23 more
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.516.2.1756902453-3.el8, jenkins-2-plugins 4.12.1756902839-1.el8
    fixed: vendor fix RHSA-2025:15813
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.516.2.1756902120-3.el8, jenkins-2-plugins 4.13.1756901992-1.el8
    fixed: vendor fix RHSA-2025:15815
  • Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.516.2.1757087588-3.el8, jenkins-2-plugins 4.14.1757087858-1.el8
    fixed: vendor fix RHSA-2025:15816
  • Red Hat OpenShift Developer Tools and Services for OCP 4.15 jenkins 2.516.2.1756738247-3.el8, jenkins-2-plugins 4.15.1756735456-1.el8
    fixed: vendor fix RHSA-2025:15817
  • Red Hat OpenShift Developer Tools and Services for OCP 4.16 jenkins 2.516.2.1756733848-3.el9, jenkins-2-plugins 4.16.1756734507-1.el9
    fixed: vendor fix RHSA-2025:15811
  • Red Hat OpenShift Developer Tools and Services for OCP 4.17 jenkins 2.516.2.1756732303-3.el9, jenkins-2-plugins 4.17.1756732064-1.el9
    fixed: vendor fix RHSA-2025:15814
  • Red Hat OpenShift Developer Tools and Services for OCP 4.18 jenkins 2.516.2.1756731431-3.el9, jenkins-2-plugins 4.18.1756731677-1.el9
    fixed: vendor fix RHSA-2025:15810
  • Red Hat OpenShift Developer Tools and Services for OCP 4.19 jenkins 2.516.2.1756903379-3.el9, jenkins-2-plugins 4.19.1756901647-1.el9
    fixed: vendor fix RHSA-2025:15812
  • Red Hat AMQ Broker 7.12.5
    fixed: vendor fix RHSA-2025:16409
  • Red Hat AMQ Broker 7.13.1
    fixed: vendor fix RHSA-2025:13274
  • Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
    fixed: vendor fix RHSA-2025:8919
  • Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7
    fixed: vendor fix RHSA-2025:9697
  • Red Hat CodeReady Linux Builder EUS (v.9.4) apache-commons-beanutils 1.9.4-9.el9_4.1
    fixed: vendor fix RHSA-2025:9696
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) apache-commons-beanutils 1.9.4-10.el9_6
    fixed: vendor fix RHSA-2025:9114
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) apache-commons-beanutils 1.9.4-21.el10_0, apache-commons-beanutils-javadoc 1.9.4-21.el10_0
    fixed: vendor fix RHSA-2025:9166
  • Red Hat Enterprise Linux CRB (v. 8) bcel 6.2-2.module+el8.10.0+23274+27840b45, xbean 4.8-1.module+el8.10.0+23274+27840b45, ant 1.10.5-1.module+el8.10.0+23274+27840b45, bsf 2.4.0-30.module+el8.10.0+23274+27840b45, junit 4.12-9.module+el8.10.0+23274+27840b45, sisu 0.3.3-7.module+el8.10.0+23274+27840b45, +507 more
    fixed: vendor fix RHSA-2025:9318
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) apache-commons-beanutils 1.8.3-15.el7_9.1, apache-commons-beanutils-javadoc 1.8.3-15.el7_9.1
    fixed: vendor fix RHSA-2025:10814
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf 3.5.10-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el7eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el7eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el7eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el7eap, +75 more
    fixed: vendor fix RHSA-2025:10924
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf 3.5.10-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el8eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el8eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el8eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el8eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el8eap, +77 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf 3.5.10-1.redhat_00001.1.el9eap, eap7-wildfly 7.4.23-3.GA_redhat_00002.1.el9eap, eap7-netty 4.1.119-1.Final_redhat_00004.1.el9eap, eap7-apache-cxf-rt 3.5.10-1.redhat_00001.1.el9eap, eap7-artemis-native 1.0.2-5.redhat_00004.1.el9eap, eap7-apache-cxf-tools 3.5.10-1.redhat_00001.1.el9eap, +76 more
    fixed: vendor fix RHSA-2025:9115
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-neethi 3.2.1-1.redhat_00002.1.el8eap, eap8-slf4j 2.0.17-1.redhat_00001.1.el8eap, eap8-velocity 2.3.0-4.redhat_00010.1.el8eap, eap8-apache-cxf 4.0.6-2.redhat_00001.1.el8eap, eap8-slf4j-api 2.0.17-1.redhat_00001.1.el8eap, eap8-wildfly 8.0.8-4.GA_redhat_00006.1.el8eap, +50 more
    fixed: vendor fix RHSA-2025:10452
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-neethi 3.2.1-1.redhat_00002.1.el9eap, eap8-slf4j 2.0.17-1.redhat_00001.1.el9eap, eap8-velocity 2.3.0-4.redhat_00010.1.el9eap, eap8-apache-cxf 4.0.6-2.redhat_00001.1.el9eap, eap8-slf4j-api 2.0.17-1.redhat_00001.1.el9eap, eap8-wildfly 8.0.8-4.GA_redhat_00006.1.el9eap, +50 more
    fixed: vendor fix RHSA-2025:10453
  • Red Hat JBoss Enterprise Application Platform commons-beanutils 1.11.0.redhat-00001
    fixed: vendor fix RHSA-2025:3467
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2025:10931

6 more fixed, 10 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

2.02% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven commons-beanutils:commons-beanutils
>=1.0, <1.11.0
1.11.0
maven org.apache.commons:commons-beanutils2
>=2.0.0-M1, <2.0.0-M2
2.0.0-M2

Affected products

  • Apache Software Foundation Apache Commons BeanUtils 1.x
  • Apache Software Foundation Apache Commons BeanUtils 2.x

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.