PT-2020-12967 · Apache · Apache Netbeans

Published 2020-09-09 · Updated 2021-03-26 · CVE-2020-11986

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NetBeans versions up to and including 12.0

Description The issue arises from the execution of build scripts to analyze gradle projects, which Apache NetBeans follows. This pattern causes the build script code to be invoked at project load time. Without requesting user consent for project analysis at load time, potentially malicious code from an external source can be executed.

Recommendations For Apache NetBeans versions up to and including 12.0, consider disabling the automatic execution of build scripts at project load time until a patch is available. Restrict access to external project sources to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-11986

Affected Products

Apache Netbeans

References · 12

• https://osv.dev/vulnerability/CVE-2020-11986 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11986 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11986 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11986 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11986 · Security Note
• https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11986 · Vendor Advisory
• https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984%40%3Cnotifications.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406%40%3Cnotifications.netbeans.apache.org%3E · Note
• https://t.me/cvenotify/11985 · Telegram Post
• https://openwall.com/lists/oss-security/2020/09/07/2 · Note