In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was
added which allows suppressing the ability for an attacker to access the
classloader via the class property available on all Java objects. We,
however were not using this by default characteristic of the
PropertyUtilsBean.

It was discovered that Apache Commons BeanUtils improperly handled certain
input. An attacker could use this vulnerability to execute arbitrary code.