Command Injection in NetBeans - CVE-2018-17191
Published: January 2, 2019
Vulnerability identifier: #VU16774
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-17191
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
NetBeans
NetBeans
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists in NetBeans Proxy Auto-Configuration (PAC) interpretation due to command. A remote unauthenticated attacker can use the nashorn script engine, cause the environment of the javascript execution for the Proxy Auto-Configuration to leak privileged objects, that can be used to circumvent the execution limits and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2018-17191
Update to version 10.0.