BeanShell is a small, free, embeddable Java source interpreter with object scripting language features,
written in Java. BeanShell dynamically executes standard Java syntax and extends it with common scripting
conveniences such as loose types, commands, and method closures like those in Perl and JavaScript.
BeanShell is a small, free, embeddable Java source interpreter with object scripting language features,
written in Java. BeanShell dynamically executes standard Java syntax and extends it with common scripting
conveniences such as loose types, commands, and method closures like those in Perl and JavaScript.
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - bsh-2.0b5.jar
BeanShell is a small, free, embeddable Java source interpreter with object scripting language features, written in Java. BeanShell dynamically executes standard Java syntax and extends it with common scripting conveniences such as loose types, commands, and method closures like those in Perl and JavaScript.
Library home page: http://www.beanshell.org/
Path to vulnerable library: /tests/regression/target/jmeter/lib/bsh-2.0b5.jar
Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2016-2510
### Vulnerable Library - bsh-2.0b5.jarBeanShell is a small, free, embeddable Java source interpreter with object scripting language features, written in Java. BeanShell dynamically executes standard Java syntax and extends it with common scripting conveniences such as loose types, commands, and method closures like those in Perl and JavaScript.
Library home page: http://www.beanshell.org/
Path to vulnerable library: /tests/regression/target/jmeter/lib/bsh-2.0b5.jar
Dependency Hierarchy: - :x: **bsh-2.0b5.jar** (Vulnerable Library)
Found in HEAD commit: d0c49807860a8c07c922d8e19168bd6893aad298
Found in base branch: master
### Vulnerability DetailsBeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Publish Date: 2016-04-07
URL: CVE-2016-2510
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2510
Release Date: 2016-04-07
Fix Resolution: 2.0b6