{"id":"CVE-2016-2510","aliases":["DEBIAN-CVE-2016-2510","DLA-443-1","DSA-3504-1","EUVD-2022-4031","GHSA-gxg6-rc6c-v673","SUSE-SU-2016:0699-1","SUSE-SU-2016:0700-1","UBUNTU-CVE-2016-2510","USN-2923-1","openSUSE-SU-2024:10420-1"],"status":"published","title":"Improper Input Validation in BeanShell","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.70425,"percentile":0.99392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19","CWE-20"],"published":"2016-02-19T00:00:00Z","modified":"2026-10-20T13:14:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache-extras.beanshell:bsh","fixed_in":["2.0b6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"bsh","fixed_in":["2.0b4-16"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bsh","fixed_in":["2.0b4-16"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bsh","fixed_in":["2.0b4-16"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"bsh","fixed_in":["2.0b4-12+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"bsh","fixed_in":["2.0b4-12+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"bsh","fixed_in":["2.0b4-15+deb8u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"bsh2","fixed_in":["2.0-318.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"bsh2","fixed_in":["2.0.0.b5-3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"bsh2","fixed_in":["2.0.0.b5-3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"bsh","fixed_in":["2.0b4-15ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bsh2","fixed_in":["2.0.0.b6-2.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache-extras.beanshell:bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0b5"},{"fixed":"2.0b6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-16"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-16"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-16"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-12+deb6u1"}]}],"versions":["2.0b4-12"]},{"source":"osv","ecosystem":"Debian:7","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-12+deb7u1"}]}],"versions":["2.0b4-12"]},{"source":"osv","ecosystem":"Debian:8","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-15+deb8u1"}]}],"versions":["2.0b4-15"]},{"source":"osv","ecosystem":"Maven","package":"org.apache-extras.beanshell:bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b6"}]}],"versions":["2.0b5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"bsh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-318.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"bsh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.b5-3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"bsh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.b5-3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-15ubuntu0.14.04.1"}]}],"versions":["2.0b4-12ubuntu1","2.0b4-15"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0b4-15ubuntu0.14.04.1"}]}],"versions":["2.0b4-12ubuntu1","2.0b4-15"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.b6-2.7"}]}]}],"products":[{"vendor":"beanshell","product":"beanshell"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2035.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/84139","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1135","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0540.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1376","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00056.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0539.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3504","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1035440","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2923-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201607-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1545","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/frohoff/ysoserial/pull/13","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/beanshell/beanshell/releases/tag/2.0b6","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.rsaconference.com/writable/presentations/file_upload/asd-f03-serial-killer-silently-pwning-your-java-endpoints.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2510","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gxg6-rc6c-v673"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2510","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967593","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2510","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160700-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2510","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2923-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2510","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-04-07T20:00:00Z","modified":"2024-08-05T23:32:20.399Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2022-4031","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-04-07T20:00:00Z","modified":"2024-08-05T23:32:20Z","updated_at":"2026-11-03T02:22:52.753944Z"}],"ghsa":[{"id":"GHSA-gxg6-rc6c-v673","title":"Improper Input Validation in BeanShell","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2022-05-13T01:14:25Z","modified":"2023-01-27T05:02:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-04-07T20:59:05.567Z","modified":"2026-06-17T00:44:11.607Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-04-07T20:59:05.567Z","modified":"2026-10-20T13:14:03.489787773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-04-07T20:59:05.567Z","modified":"2026-09-22T07:01:51.111170861Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-gxg6-rc6c-v673","title":"Improper Input Validation in BeanShell","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2022-05-13T01:14:25Z","modified":"2023-11-08T03:58:24.40426Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"UBUNTU-CVE-2016-2510","description":"BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.","status":"published","published":"2016-02-19T00:00:00Z","modified":"2026-02-04T02:26:24.524231Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-443-1","title":"bsh - security update","status":"published","published":"2016-02-29T00:00:00Z","modified":"2026-03-09T02:11:14.862758Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-3504-1","title":"bsh - security update","status":"published","published":"2016-03-04T00:00:00Z","modified":"2026-03-09T01:18:40.132269Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10420-1","title":"bsh2-2.0.0.b6-2.7 on GA media","description":"These are all security issues fixed in the bsh2-2.0.0.b6-2.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:23.759976Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:0699-1","title":"Security update for bsh2","description":"\nThis update for bsh2 fixes the following issue:\n\n- CVE-2016-2510: An application that includes BeanShell on the\n  classpath may be vulnerable if another part of the application uses Java\n  serialization or XStream to deserialize data from an untrusted source.\n\nPlease see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.\n","status":"published","published":"2016-03-09T08:03:57Z","modified":"2026-02-04T03:29:19.944527Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0700-1","title":"Security update for bsh2","description":"\nThis update for bsh2 fixes the following issues: \n\n- CVE-2016-2510: An application that includes BeanShell on the\n  classpath may be vulnerable if another part of the application uses Java\n  serialization or XStream to deserialize data from an untrusted source.\n\nPlease see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information.\n","status":"published","published":"2016-03-09T08:03:33Z","modified":"2026-02-04T04:21:25.522157Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2923-1","title":"bsh vulnerability","description":"Alvaro Muñoz and Christian Schneider discovered that BeanShell incorrectly\nhandled deserialization. A remote attacker could possibly use this issue\nto execute arbitrary code.\n","status":"published","published":"2016-03-08T13:56:38Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}