Critical severity · published Mar 30, 2020
CVE-2019-17560
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads
9.1
CVSS
2.3%
EPSS
No
On KEV
Description
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Graalvm · Oracle
19.3.2; 20.1.0 · source: NVD
NE
Netbeans · Apache
through 11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17560
Mailing List
https://lists.apache.org/thread.html/r354d7654efa1050539fe56a3257696d1faeea4f3f9b633c29ec89609%40%3Cdev.netbeans.apache.org%3E
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
More from Netbeans
9.8
CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed
9.8
CVE-2018-17191
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE)
7.5
CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures