CVE-2019-9186

Published: Jul 3, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

Affected (4)

Products: Jetbrains: Intellij Idea

Jetbrains

1 product

Intellij Idea

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Intellij Idea	From 2018.1 to 2018.1.8
Jetbrains Intellij Idea	From 2018.2 to 2018.2.8
Jetbrains Intellij Idea	From 2018.3 to 2018.3.5
Jetbrains Intellij Idea	From 2018.3.6 to 2019.1

Related CWEs

CWE-668

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References (2)

https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/

Source: cve@mitre.org

Vendor Advisory

https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.