CVE-2025-48734: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Improper Access Control vulnerability in Apache Commons.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.commons:commons-beanutils2to a version that resolves this vulnerability.Fixed in 2.0.0-M2 - Upgrade
Upgrade
maven/commons-beanutils:commons-beanutilsto a version that resolves this vulnerability.Fixed in 1.11.0 - Upgrade
Upgrade
debian/commons-beanutilsto a version that resolves this vulnerability.Fixed in 1.9.4-1+deb11u1Fixed in 1.9.4-1+deb12u1Fixed in 1.10.1-1.1 - Upgrade
Upgrade
Apache Commons BeanUtils (commons-beanutils)to a version that resolves this vulnerability.Fixed in 1.11.0 - Upgrade
Upgrade
Apache Commons BeanUtils 2 (org.apache.commons:commons-beanutils2)to a version that resolves this vulnerability.Fixed in 2.0.0-M2Patch CVE-2025-48734 - Configuration
Ensure the special BeanIntrospector that suppresses the enum "declaredClass" property is enabled (do not disable it). This addresses the improper access control when external property paths are passed to PropertyUtilsBean.getProperty() / getNestedProperty().
Apache Commons BeanUtils BeanIntrospector / PropertyUtilsBean BeanIntrospector (declaredClass suppression behavior) = enabled by default (disable only to regain old behavior)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48734?
CVE-2025-48734 has a medium severity rating due to improper access control vulnerabilities in Apache Commons.
How do I fix CVE-2025-48734?
To fix CVE-2025-48734, upgrade to Apache Commons BeanUtils version 1.11.0 or later.
Which versions of Apache Commons BeanUtils are affected by CVE-2025-48734?
CVE-2025-48734 affects Apache Commons BeanUtils versions prior to 1.11.0 and 2.0.0-M2.
What type of vulnerability is CVE-2025-48734?
CVE-2025-48734 is classified as an improper access control vulnerability.
Is there a workaround for CVE-2025-48734?
There is no official workaround for CVE-2025-48734; upgrading to a patched version is recommended.