What’s Vulnerable › Vulnerabilities

CVE-2018-17191

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-31 · updated 2026-06-17

Description

Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.

Affected products

• Apache NetBeans: 9.0

References

• http://www.securityfocus.com/bid/106352
• https://lists.apache.org/thread.html/d1c37966a316a326ab4ff4d4bc056322e8adcbe984e8145c0ecda7fa%40%3Cdev.netbeans.apache.org%3E
• http://www.securityfocus.com/bid/106352
• https://lists.apache.org/thread.html/d1c37966a316a326ab4ff4d4bc056322e8adcbe984e8145c0ecda7fa%40%3Cdev.netbeans.apache.org%3E

Get alerted when CVE-2018-17191 or the next vulnerability affects your stack