CVE-2020-11986: Critical severity oracle netbeans vulnerability
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11986?
CVE-2020-11986 is classified as a medium severity vulnerability due to potential security risks associated with executing untrusted build scripts without user consent.
How do I fix CVE-2020-11986?
To fix CVE-2020-11986, it is recommended to upgrade to Apache NetBeans version 12.1 or later where user consent for build script execution is implemented.
What happens if I don't address CVE-2020-11986?
If CVE-2020-11986 is not addressed, it may allow untrusted code execution, potentially compromising the security of the user's system.
Who is affected by CVE-2020-11986?
CVE-2020-11986 affects all users of Apache NetBeans versions up to and including 12.0.
What type of vulnerability is CVE-2020-11986?
CVE-2020-11986 is a code execution vulnerability that arises from Apache NetBeans executing build scripts without explicit user consent.