CVE-2024-37051

Monday, June 10, 2024

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Summary

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Affected Software

Vendor	Product	Version Range	Status
JetBrains	IntelliJ IDEA	`2023.1 < 2023.1.7`	affected
JetBrains	IntelliJ IDEA	`2023.1 < 2023.2.7`	affected
JetBrains	IntelliJ IDEA	`2023.1 < 2023.3.7`	affected
JetBrains	IntelliJ IDEA	`2023.1 < 2024.1.3`	affected
JetBrains	IntelliJ IDEA	`2023.1 < 2024.2 EAP3`	affected
JetBrains	Aqua	`0 < 2024.1.2`	affected
JetBrains	CLion	`2023.1 < 2023.1.7`	affected
JetBrains	CLion	`2023.1 < 2023.2.4`	affected
JetBrains	CLion	`2023.1 < 2023.3.5`	affected
JetBrains	CLion	`2023.1 < 2024.1.3`	affected
JetBrains	CLion	`2023.1 < 2024.2 EAP2`	affected
JetBrains	DataGrip	`2023.1 < 2023.1.3`	affected
JetBrains	DataGrip	`2023.1 < 2023.2.4`	affected
JetBrains	DataGrip	`2023.1 < 2023.3.5`	affected
JetBrains	DataGrip	`2023.1 < 2024.1.4`	affected
JetBrains	DataSpell	`2023.1 < 2023.1.6`	affected
JetBrains	DataSpell	`2023.1 < 2023.2.7`	affected
JetBrains	DataSpell	`2023.1 < 2023.3.6`	affected
JetBrains	DataSpell	`2023.1 < 2024.1.2`	affected
JetBrains	DataSpell	`2023.1 < 2024.2 EAP1`	affected
JetBrains	GoLand	`2023.1 < 2023.1.6`	affected
JetBrains	GoLand	`2023.1 < 2023.2.7`	affected
JetBrains	GoLand	`2023.1 < 2023.3.7`	affected
JetBrains	GoLand	`2023.1 < 2024.1.3`	affected
JetBrains	GoLand	`2023.1 < 2024.2 EAP3`	affected
JetBrains	MPS	`2023.1 < 2023.2.1`	affected
JetBrains	MPS	`2023.1 < 2023.3.1`	affected
JetBrains	MPS	`2023.1 < 2024.1 EAP2`	affected
JetBrains	PhpStorm	`2023.1 < 2023.1.6`	affected
JetBrains	PhpStorm	`2023.1 < 2023.2.6`	affected
JetBrains	PhpStorm	`2023.1 < 2023.3.7`	affected
JetBrains	PhpStorm	`2023.1 < 2024.1.3`	affected
JetBrains	PhpStorm	`2023.1 < 2024.2 EAP3`	affected
JetBrains	PyCharm	`2023.1 < 2023.1.6`	affected
JetBrains	PyCharm	`2023.1 < 2023.2.7`	affected
JetBrains	PyCharm	`2023.1 < 2023.3.6`	affected
JetBrains	PyCharm	`2023.1 < 2024.1.3`	affected
JetBrains	PyCharm	`2023.1 < 2024.2 EAP2`	affected
JetBrains	Rider	`2023.1 < 2023.1.7`	affected
JetBrains	Rider	`2023.1 < 2023.2.5`	affected
JetBrains	Rider	`2023.1 < 2023.3.6`	affected
JetBrains	Rider	`2023.1 < 2024.1.3`	affected
JetBrains	RubyMine	`2023.1 < 2023.1.7`	affected
JetBrains	RubyMine	`2023.1 < 2023.2.7`	affected
JetBrains	RubyMine	`2023.1 < 2023.3.7`	affected
JetBrains	RubyMine	`2023.1 < 2024.1.3`	affected
JetBrains	RubyMine	`2023.1 < 2024.2 EAP4`	affected
JetBrains	RustRover	`0 < 2024.1.1`	affected
JetBrains	WebStorm	`2023.1 < 2023.1.6`	affected
JetBrains	WebStorm	`2023.1 < 2023.2.7`	affected
JetBrains	WebStorm	`2023.1 < 2023.3.7`	affected
JetBrains	WebStorm	`2023.1 < 2024.1.4`	affected

Weaknesses

CWE-522: CWE-522: Insufficiently Protected Credentials

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: no
- Technical Impact: total

CVE Program Container

Additional References

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.