CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Apache NetBeans
Apache NetBeans up to 12.0
References 3
lists.apache.org
- thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e@<announce.netbeans.apache.org>
- thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406@<notifications.netbeans.apache.org>
- thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984@<notifications.netbeans.apache.org>