CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean
Vendor: The Apache Software Foundation
Versions Affected: commons-beanutils-1.9.3 and earlier
Description: A special BeanIntrospector class was added in version 1.9.2.
This can be used to stop attackers from using the class property of
Java objects to get access to the classloader.
However this protection was not enabled by default.
PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
level property access by default, thus protecting against
Mitigation: 1.X users should migrate to 1.9.4.