Critical severity · published Sep 9, 2020
CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed
9.8
CVSS
9.9%
EPSS
No
On KEV
Description
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netbeans · Apache
through 12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11986
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11986
lists.apache.org
https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406%40%3Cnotifications.netbeans.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984%40%3Cnotifications.netbeans.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E
More from Netbeans
9.8
CVE-2018-17191
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE)
9.1
CVE-2019-17560
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads
7.5
CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures