CVE-2019-17561

HIGH

Apache NetBeans <= 11.2 - Improper Verification of Cryptographic Signature

Title source: llm

Description

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpujul2020.html

Mailing List, Mitigation, Vendor Advisory x_refsource_misc

https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E

Scores

CVSS v3 7.5

EPSS 0.0073

EPSS Percentile 72.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-347

Status published

Products (4)

apache/netbeans < 11.2

oracle/graalvm 19.3.2

oracle/graalvm 20.1.0

org.codehaus.mevenide/netbeans 0Maven

Published Mar 30, 2020

Tracked Since Feb 18, 2026