CVE-2024-37051

Published: Jun 10, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Affected (44)

Products: Jetbrains: Aqua, Clion, Datagrip, Dataspell, Goland, Intellij Idea, Mps, Phpstorm, Pycharm, Rider, Rubymine, Rustrover, Webstorm

13 products

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Aqua	version < 2024.1.2
Jetbrains Clion	version < 2023.1.7
Jetbrains Clion	2023.2.0 ≤ version < 2023.2.4
Jetbrains Clion	2023.3.0 ≤ version < 2023.3.5
Jetbrains Clion	2024.1.0 ≤ version < 2024.1.3
Jetbrains Datagrip	2023.1.0 ≤ version < 2023.1.3
Jetbrains Datagrip	2023.2.0 ≤ version < 2023.2.4
Jetbrains Datagrip	2023.3.0 ≤ version < 2023.3.5
Jetbrains Datagrip	2024.1.0 ≤ version < 2024.1.4
Jetbrains Dataspell	version < 2023.1.6
Jetbrains Dataspell	2023.2.0 ≤ version < 2023.2.7
Jetbrains Dataspell	2023.3.0 ≤ version < 2023.3.6
Jetbrains Dataspell	2024.1.0 ≤ version < 2024.1.2
Jetbrains Goland	version < 2023.1.6
Jetbrains Goland	2023.2.0 ≤ version < 2023.2.7
Jetbrains Goland	2023.3.0 ≤ version < 2023.3.7
Jetbrains Goland	2024.1.0 ≤ version < 2024.1.3
Jetbrains Intellij Idea	version < 2023.1.7
Jetbrains Intellij Idea	2023.2.0 ≤ version < 2023.2.7
Jetbrains Intellij Idea	2023.3.0 ≤ version < 2023.3.7
Jetbrains Intellij Idea	2024.1.0 ≤ version < 2024.1.3
Jetbrains Mps	version < 2023.2.1
Jetbrains Mps	Version 2023.3.0
Jetbrains Phpstorm	version < 2023.1.6
Jetbrains Phpstorm	2023.2.0 ≤ version < 2023.2.6
Jetbrains Phpstorm	2023.3.0 ≤ version < 2023.3.7
Jetbrains Phpstorm	2024.1.0 ≤ version < 2024.1.3
Jetbrains Pycharm	version < 2023.1.6
Jetbrains Pycharm	2023.2.0 ≤ version < 2023.2.7
Jetbrains Pycharm	2023.3.0 ≤ version < 2023.3.6
Jetbrains Pycharm	2024.1.0 ≤ version < 2024.1.3
Jetbrains Rider	version < 2023.1.7
Jetbrains Rider	2023.2.0 ≤ version < 2023.2.5
Jetbrains Rider	2023.3.0 ≤ version < 2023.3.6
Jetbrains Rider	2024.1.0 ≤ version < 2024.1.3
Jetbrains Rubymine	version < 2023.1.7
Jetbrains Rubymine	2023.2.0 ≤ version < 2023.2.7
Jetbrains Rubymine	2023.3.0 ≤ version < 2023.3.7
Jetbrains Rubymine	2024.1.0 ≤ version < 2024.1.3
Jetbrains Rustrover	version < 2024.1.1
Jetbrains Webstorm	version < 2023.1.6
Jetbrains Webstorm	2023.2.0 ≤ version < 2023.2.7
Jetbrains Webstorm	2023.3.0 ≤ version < 2023.3.7
Jetbrains Webstorm	2024.1.0 ≤ version < 2024.1.4

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (4)

https://security.netapp.com/advisory/ntap-20240705-0004/

Source: cve@jetbrains.com

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240705-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.