Vulnerability Details CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 72.0%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E
- https://www.oracle.com/security-alerts/cpujul2020.html
Products affected by CVE-2019-17561
-
cpe:2.3:a:apache:netbeans:10.0
-
cpe:2.3:a:apache:netbeans:11.0
-
cpe:2.3:a:apache:netbeans:11.1
-
cpe:2.3:a:apache:netbeans:11.2
-
cpe:2.3:a:apache:netbeans:9.0
-
cpe:2.3:a:oracle:graalvm:19.3.2
-
cpe:2.3:a:oracle:graalvm:20.1.0