CVE-2019-17561 describes a critical vulnerability in the autoupdate system of Apache NetBeans versions up to and including 11.2, as well as related Oracle and Apache GraalVM products. The flaw, categorized as CWE-347 (Improper Verification of Cryptographic Signature), allows an attacker to modify downloaded update packages (nbm files) and inject malicious code due to insufficient code signature validation. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, potentially leading to high integrity impact without requiring user interaction. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion, and it is not listed on the KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 11.2CPE matchmatch criteria | cpe:2.3:a:apache:netbeans:*:*:*:*:*:*:*:* | ||
19.3.2CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:* | ||
20.1.0CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.