CVE-2020-11986
First published: Wed Sep 09 2020(Updated: )
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache NetBeans | <=12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406@%3Cnotifications.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984@%3Cnotifications.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406%40%3Cnotifications.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984%40%3Cnotifications.netbeans.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2020-11986?
CVE-2020-11986 is classified as a medium severity vulnerability due to potential security risks associated with executing untrusted build scripts without user consent.
How do I fix CVE-2020-11986?
To fix CVE-2020-11986, it is recommended to upgrade to Apache NetBeans version 12.1 or later where user consent for build script execution is implemented.
What happens if I don't address CVE-2020-11986?
If CVE-2020-11986 is not addressed, it may allow untrusted code execution, potentially compromising the security of the user's system.
Who is affected by CVE-2020-11986?
CVE-2020-11986 affects all users of Apache NetBeans versions up to and including 12.0.
What type of vulnerability is CVE-2020-11986?
CVE-2020-11986 is a code execution vulnerability that arises from Apache NetBeans executing build scripts without explicit user consent.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/softwarecombine
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/apache
- canonical/apache netbeans
- version/apache netbeans/12.0