VDB
CVE-2020-11986
CVE-2020-11986
PUBLISHED
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
EPSS 5.13% · 90.0th percentile
Risk Scores
EPSS Score
5.13%
90.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | netbeans | 10.0-3~18.04.1ubuntu1, 10.0-3ubuntu2~18.04.1, 0 |
| Ubuntu:20.04:LTS | netbeans | 0, 10.0-3ubuntu3 |
| Ubuntu:25.10 | netbeans | 12.1-3, 0 |
| Ubuntu:16.04:LTS | netbeans | 0, 8.0.2+dfsg1-5, 8.0.2+dfsg1-4 |
| Ubuntu:22.04:LTS | netbeans | 12.1-3, 0 |
| Ubuntu:24.04:LTS | netbeans | 0, 12.1-3 |
Exploit Intelligence
- https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E (circl)
- [netbeans-notifications] 20210322 [GitHub] [netbeans] jtulach commented on pull request #2822: Offer to trust and prime the project when it is being opened. (circl)
- [netbeans-notifications] 20210322 [GitHub] [netbeans] jtulach edited a comment on pull request #2822: Offer to trust and prime the project when it is being opened. (circl)
Timeline
- Sep 9, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-11986 third-party-advisory
- https://www.openwall.com/lists/oss-security/2020/09/07/2 third-party-advisory
- https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11986 third-party-advisory