Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-17560

Good to know:

icon
icon

Date: March 30, 2020

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Language: Java

Severity Score

Related Resources (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-17560
https://www.oracle.com/security-alerts/cpujul2020.html
https://lists.apache.org/thread.html/r354d7654efa1050539fe56a3257696d1faeea4f3f9b633c29ec89609%40%3Cdev.netbeans.apache.org%3E
https://www.mend.io/vulnerability-database/CVE-2019-17560

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

Top Fix

icon

Upgrade Version

Upgrade to version org.netbeans.api:org-netbeans-modules-autoupdate-services:RELEASE113

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us