CVE-2018-17191: Critical severity oracle netbeans vulnerability

Published Dec 31, 2018

Updated

Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.

Affected Software

1 affected component

Apache NetBeans=9.0

Event History

Dec 31, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-17191?

CVE-2018-17191 is classified with a high severity due to its potential for remote command execution.

How do I fix CVE-2018-17191?

To mitigate CVE-2018-17191, it is recommended to update Apache NetBeans to a version that has addressed this vulnerability.

What versions of Apache NetBeans are affected by CVE-2018-17191?

CVE-2018-17191 affects Apache NetBeans version 9.0.

What type of vulnerability is CVE-2018-17191?

CVE-2018-17191 is a remote command execution (RCE) vulnerability.

Can CVE-2018-17191 be exploited remotely?

Yes, CVE-2018-17191 can be exploited remotely due to the vulnerable Proxy Auto-Configuration interpretation.