CVE-2024-37051

Published: Jun 10, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Affected (44)

Products: Jetbrains: Aqua, Clion, Datagrip, Dataspell, Goland, Intellij Idea, Mps, Phpstorm, Pycharm, Rider, Rubymine, Rustrover, Webstorm

13 products

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Aqua	Before 2024.1.2
Jetbrains Clion	Before 2023.1.7
Jetbrains Clion	From 2023.2.0 to 2023.2.4
Jetbrains Clion	From 2023.3.0 to 2023.3.5
Jetbrains Clion	From 2024.1.0 to 2024.1.3
Jetbrains Datagrip	From 2023.1.0 to 2023.1.3
Jetbrains Datagrip	From 2023.2.0 to 2023.2.4
Jetbrains Datagrip	From 2023.3.0 to 2023.3.5
Jetbrains Datagrip	From 2024.1.0 to 2024.1.4
Jetbrains Dataspell	Before 2023.1.6
Jetbrains Dataspell	From 2023.2.0 to 2023.2.7
Jetbrains Dataspell	From 2023.3.0 to 2023.3.6
Jetbrains Dataspell	From 2024.1.0 to 2024.1.2
Jetbrains Goland	Before 2023.1.6
Jetbrains Goland	From 2023.2.0 to 2023.2.7
Jetbrains Goland	From 2023.3.0 to 2023.3.7
Jetbrains Goland	From 2024.1.0 to 2024.1.3
Jetbrains Intellij Idea	Before 2023.1.7
Jetbrains Intellij Idea	From 2023.2.0 to 2023.2.7
Jetbrains Intellij Idea	From 2023.3.0 to 2023.3.7
Jetbrains Intellij Idea	From 2024.1.0 to 2024.1.3
Jetbrains Mps	Before 2023.2.1
Jetbrains Mps	Version 2023.3.0
Jetbrains Phpstorm	Before 2023.1.6
Jetbrains Phpstorm	From 2023.2.0 to 2023.2.6
Jetbrains Phpstorm	From 2023.3.0 to 2023.3.7
Jetbrains Phpstorm	From 2024.1.0 to 2024.1.3
Jetbrains Pycharm	Before 2023.1.6
Jetbrains Pycharm	From 2023.2.0 to 2023.2.7
Jetbrains Pycharm	From 2023.3.0 to 2023.3.6
Jetbrains Pycharm	From 2024.1.0 to 2024.1.3
Jetbrains Rider	Before 2023.1.7
Jetbrains Rider	From 2023.2.0 to 2023.2.5
Jetbrains Rider	From 2023.3.0 to 2023.3.6
Jetbrains Rider	From 2024.1.0 to 2024.1.3
Jetbrains Rubymine	Before 2023.1.7
Jetbrains Rubymine	From 2023.2.0 to 2023.2.7
Jetbrains Rubymine	From 2023.3.0 to 2023.3.7
Jetbrains Rubymine	From 2024.1.0 to 2024.1.3
Jetbrains Rustrover	Before 2024.1.1
Jetbrains Webstorm	Before 2023.1.6
Jetbrains Webstorm	From 2023.2.0 to 2023.2.7
Jetbrains Webstorm	From 2023.3.0 to 2023.3.7
Jetbrains Webstorm	From 2024.1.0 to 2024.1.4

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (4)

https://security.netapp.com/advisory/ntap-20240705-0004/

Source: cve@jetbrains.com

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240705-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.