Vulnerability in Apache Netbeans
CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12…
EPSS: 0.099 (95.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Netbeans
- N/a Apache Netbeans — versions Apache NetBeans up to 12.0
Public proof-of-concept exploits
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2020-11986?
- CVE-2020-11986 is a critical-severity vulnerability in Apache Netbeans. CVSS score: 9.8/10. Published 2020-09-09.
- How severe is CVE-2020-11986?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-11986 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.