Vulnerability Details : CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Products affected by CVE-2019-17561
- cpe:2.3:a:apache:netbeans:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-17561
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-17561
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-17561
-
The product does not verify, or incorrectly verifies, the cryptographic signature for data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-17561
-
https://www.oracle.com/security-alerts/cpujul2020.html
Oracle Critical Patch Update Advisory - July 2020Patch;Third Party Advisory
-
https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E
[CVE-2019-17561] "Apache NetBeans" autoupdate system does not fully validate code signatures. - Pony MailMailing List;Mitigation;Vendor Advisory
Jump to