CVE-2019-17560

Improper Certificate Validation in Apache Netbeans

9.1 CriticalFix available

CVE-2019-17560 is a critical vulnerability (CVSS 9.1) in Apache Netbeans, published March 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in netbeans 12.1-1.

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

2.32%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

Record: CVE-2019-17560
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-17560
Updated: 2026-11-02

EUVDEUVD-2022-2969 No score

Record: EUVD-2022-2969
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7c2m-vwxw-5qww 9.1

Improper Certificate Validation in Apache Netbeans

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.

Record: GHSA-7c2m-vwxw-5qww
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV 9.1

Record: CVE-2019-17560
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-17560 9.1

Record: DEBIAN-CVE-2019-17560
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-7c2m-vwxw-5qww 9.1

Improper Certificate Validation in Apache Netbeans

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.

Record: GHSA-7c2m-vwxw-5qww
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-17560 9.1

Record: UBUNTU-CVE-2019-17560
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.codehaus.mevenide:netbeans` Maven	through 3.1.4	None known
`netbeans` Debian:12	before 12.1-1	12.1-1
`netbeans` Debian:13	before 12.1-1	12.1-1
`netbeans` Debian:14	before 12.1-1	12.1-1
`org.codehaus.mevenide:netbeans` Maven	through 3.1.4, plus listed versions 1.21.31.43.0.103.0.123.0.93.1.1	None known
`netbeans` Ubuntu:16.04:LTS	All versions, plus listed versions 8.0.2+dfsg1-48.0.2+dfsg1-58.1+dfsg1-18.1+dfsg2-18.1+dfsg2-3	None known
`netbeans` Ubuntu:18.04:LTS	All versions, plus listed versions 8.1+dfsg3-410.0-3~18.04.1ubuntu110.0-3ubuntu2~18.04.1	None known
`netbeans` Ubuntu:20.04:LTS	All versions, plus listed versions 10.0-3ubuntu3	None known
`netbeans` Ubuntu:22.04:LTS	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:24.04:LTS	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:25.10	All versions, plus listed versions 12.1-3	None known
`netbeans` Ubuntu:26.10	All versions, plus listed versions 12.1-3build1	None known
`netbeans` Ubuntu:26.04:LTS	All versions, plus listed versions 12.1-312.1-3build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV