JetBrains IntelliJ IDEA
At a glance
- Source
- NVD
- EPSS
- EPSS 4.88 % · percentile 92 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- JetBrains
- NVD status
- Modified
Description
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
Weaknesses (CWE)
- CWE-522 — Insufficiently Protected Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | JetBrains |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | NVD · cve@jetbrains.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-36408
- GCVE · GCVE-0-2024-37051
Affected configurations (NVD CPE)
cpe:2.3:a:jetbrains:aqua:*:*:*:*:*:*:*:*< 2024.1.2cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:*< 2023.1.7cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.4cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.5cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:*≥ 2023.1.0 < 2023.1.3cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.4cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.5cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.4cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:*< 2023.1.6cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.7cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.6cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.2cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*< 2023.1.6cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.7cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.7cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*< 2023.1.7cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.7cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.7cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:mps:*:*:*:*:*:*:*:*< 2023.2.1cpe:2.3:a:jetbrains:mps:2023.3.0:*:*:*:*:*:*:*cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*< 2023.1.6cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.6cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.7cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*< 2023.1.6cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.7cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.6cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*< 2023.1.7cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.5cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.6cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:*< 2023.1.7cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:*≥ 2023.2.0 < 2023.2.7cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:*≥ 2023.3.0 < 2023.3.7cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:*≥ 2024.1.0 < 2024.1.3cpe:2.3:a:jetbrains:rustrover:*:*:*:*:*:*:*:*< 2024.1.1- +4 more
Affected products
| Product | Versions |
|---|---|
| JetBrains · IntelliJ IDEA | affected 2023.1 < 2023.1.7 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.7 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP3 |
| JetBrains · Aqua | affected 0 < 2024.1.2 |
| JetBrains · CLion | affected 2023.1 < 2023.1.7 ; affected 2023.1 < 2023.2.4 ; affected 2023.1 < 2023.3.5 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP2 |
| JetBrains · DataGrip | affected 2023.1 < 2023.1.3 ; affected 2023.1 < 2023.2.4 ; affected 2023.1 < 2023.3.5 ; affected 2023.1 < 2024.1.4 |
| JetBrains · DataSpell | affected 2023.1 < 2023.1.6 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.6 ; affected 2023.1 < 2024.1.2 ; affected 2023.1 < 2024.2 EAP1 |
| JetBrains · GoLand | affected 2023.1 < 2023.1.6 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.7 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP3 |
| JetBrains · MPS | affected 2023.1 < 2023.2.1 ; affected 2023.1 < 2023.3.1 ; affected 2023.1 < 2024.1 EAP2 |
| JetBrains · PhpStorm | affected 2023.1 < 2023.1.6 ; affected 2023.1 < 2023.2.6 ; affected 2023.1 < 2023.3.7 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP3 |
| JetBrains · PyCharm | affected 2023.1 < 2023.1.6 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.6 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP2 |
| JetBrains · Rider | affected 2023.1 < 2023.1.7 ; affected 2023.1 < 2023.2.5 ; affected 2023.1 < 2023.3.6 ; affected 2023.1 < 2024.1.3 |
| JetBrains · RubyMine | affected 2023.1 < 2023.1.7 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.7 ; affected 2023.1 < 2024.1.3 ; affected 2023.1 < 2024.2 EAP4 |
| JetBrains · RustRover | affected 0 < 2024.1.1 |
| JetBrains · WebStorm | affected 2023.1 < 2023.1.6 ; affected 2023.1 < 2023.2.7 ; affected 2023.1 < 2023.3.7 ; affected 2023.1 < 2024.1.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |