CVE-2025-48734 Fix : Beanutils commons

[Krish-cloudsufi]

Issue:
Apache Commons BeanUtils versions prior to 1.11.0 (1.x) and 2.0.0-M2 (2.x) allowed unauthorized access to the declaredClass property of Java enum objects via PropertyUtilsBean.getProperty() or PropertyUtilsBean.getNestedProperty(). This vulnerability could allow an attacker to access the enum’s classloader and potentially execute arbitrary code. The root cause was that the protective BeanIntrospector introduced in version 1.9.2 was not enabled by default in older versions.

Root Cause:
PropertyUtilsBean allowed access to the declaredClass property of enum objects, enabling attackers to access the ClassLoader. The protective BeanIntrospector introduced in version 1.9.2 suppressed access to declaredClass but was not enabled by default.

Fix:
Upgraded commons-beanutils:commons-beanutils from version 1.9.4 to 1.11.0. This upgrade enables the protective BeanIntrospector by default, preventing unauthorized access to enum classloaders.
The fix is included as part of the forced wsc library upgrade from 64.0.0 to 65.0.0, which brought in the updated BeanUtils version.

CVE Fix Verification: https://screenshot.googleplex.com/AGvRfJfiYfk4W4E

Pipeline Run: https://screenshot.googleplex.com/8UraQyBsrsHhFJA

JIRA : [PLUGIN-1937]

[sgarg-CS]

LGTM. Please attach testing evidence by adding a link to the screenshot of CVE scan and a successful pipeline run for Salesforce Plugin on CDAP.