VULNERABILITY INTELLIGENCE

CVE-2019-17560

CVSS score9.1 CRITICAL

EPSS probability2.32%

CISA KEVNot currently listed

Published2020-03-30

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Weakness classification

CWE-295: Improper Certificate Validation

Primary references

security@apache.org — Mailing List, Mitigation, Vendor Advisory
security@apache.org — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory