CVE-2019-17560

CRITICAL

Apache NetBeans <= 11.2 - Improper Certificate Validation in Autoupdate System

Title source: llm

Description

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpujul2020.html

Mailing List, Mitigation, Vendor Advisory x_refsource_misc

https://lists.apache.org/thread.html/r354d7654efa1050539fe56a3257696d1faeea4f3f9b633c29ec89609%40%3Cdev.netbeans.apache.org%3E

Scores

CVSS v3 9.1

EPSS 0.0155

EPSS Percentile 81.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-295

Status published

Products (4)

apache/netbeans < 11.2

oracle/graalvm 19.3.2

oracle/graalvm 20.1.0

org.codehaus.mevenide/netbeans 0Maven

Published Mar 30, 2020

Tracked Since Feb 18, 2026