CVE-2024-37051

State: Published
Severity: 9.3 Critical
Published: Jun 10, 2024
Updated: Feb 13, 2025
Reserved: May 31, 2024

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N	JetBrains

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
IntelliJ IDEAJetBrains	2023.1 to before 2023.1.7Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.7Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP3Affected
AquaJetBrains	before 2024.1.2Affected
CLionJetBrains	2023.1 to before 2023.1.7Affected 2023.1 to before 2023.2.4Affected 2023.1 to before 2023.3.5Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP2Affected
DataGripJetBrains	2023.1 to before 2023.1.3Affected 2023.1 to before 2023.2.4Affected 2023.1 to before 2023.3.5Affected 2023.1 to before 2024.1.4Affected
DataSpellJetBrains	2023.1 to before 2023.1.6Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.6Affected 2023.1 to before 2024.1.2Affected 2023.1 to before 2024.2 EAP1Affected
GoLandJetBrains	2023.1 to before 2023.1.6Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.7Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP3Affected
MPSJetBrains	2023.1 to before 2023.2.1Affected 2023.1 to before 2023.3.1Affected 2023.1 to before 2024.1 EAP2Affected
PhpStormJetBrains	2023.1 to before 2023.1.6Affected 2023.1 to before 2023.2.6Affected 2023.1 to before 2023.3.7Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP3Affected
PyCharmJetBrains	2023.1 to before 2023.1.6Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.6Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP2Affected
RiderJetBrains	2023.1 to before 2023.1.7Affected 2023.1 to before 2023.2.5Affected 2023.1 to before 2023.3.6Affected 2023.1 to before 2024.1.3Affected
RubyMineJetBrains	2023.1 to before 2023.1.7Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.7Affected 2023.1 to before 2024.1.3Affected 2023.1 to before 2024.2 EAP4Affected
RustRoverJetBrains	before 2024.1.1Affected
WebStormJetBrains	2023.1 to before 2023.1.6Affected 2023.1 to before 2023.2.7Affected 2023.1 to before 2023.3.7Affected 2023.1 to before 2024.1.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.