1. Home
  2. CVE Database
  3. CVE-2019-17560
CRITICAL · 9.1

CVE-2019-17560

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the downloa...

Vulnerability Description

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ApacheNetbeans<= 11.2
OracleGraalvm19.3.2

Related Weaknesses (CWE)

CWE-295

References

FAQ

What is CVE-2019-17560?

CVE-2019-17560 is a vulnerability with a CVSS score of 9.1 (CRITICAL). The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the downloa...

How severe is CVE-2019-17560?

CVE-2019-17560 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-17560?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Netbeans, Oracle Graalvm.