Improper Input Validation in BeanShell

HIGH 8.1CVE-2016-2510 · GHSA-gxg6-rc6c-v673 · Published 07/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache-extras.beanshell:bsh Maven	`< 2.0b6`	`2.0b6`
beanshell beanshell	`= 1.0= 2.0`	No fix yet

Description

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-2510 · ADVISORY
frohoff/ysoserial#13 · WEB
beanshell/beanshell commit 1ccc66b · WEB
beanshell/beanshell commit 7c68fde · WEB
access.redhat.com/errata/RHSA-2016:1135 · WEB
access.redhat.com/errata/RHSA-2016:1376 · WEB
access.redhat.com/errata/RHSA-2019:1545 · WEB
beanshell/beanshell release 2.0b6 · WEB
security.gentoo.org/glsa/201607-17 · WEB
oracle.com/security-alerts/cpuoct2020.html · WEB
rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf · WEB
lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html · WEB
lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html · WEB
rhn.redhat.com/errata/RHSA-2016-0539.html · WEB
rhn.redhat.com/errata/RHSA-2016-0540.html · WEB
rhn.redhat.com/errata/RHSA-2016-2035.html · WEB
debian.org/security/2016/dsa-3504 · WEB
ubuntu.com/usn/USN-2923-1 · WEB
securityfocus.com/bid/84139 · Third Party Advisory
securitytracker.com/id/1035440 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free