CyberzSOC

Publication detail
← Back to advisories & guidance

2024-057: Vulnerabilities in JetBrains Products ↗ source

June 12, 2024 CERT-EU Advisory
Source: https://cert.europa.eu/publications/security-advisories/2024-057/

Summary

This vulnerability could lead to disclosure of access tokens to The vulnerability, identified as CVE-2024-37051 with a CVSS score of 9.3 [2], affects pull requests within the IntelliJ-based IDEs. Specifically, malicious content included in a pull request to a GitHub project, when handled by IntelliJ-based IDEs, could lead to exposure of access The fixed versions are listed below. Recommendations and Mitigation It is recommended to apply updates as soon as possible on affected products. Additionally, it is advised to revoke any GitHub tokens being used by JetBrains GitHub Plugin. The plugin can use OAuth integration or Personal Access Token (PAT).

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-37051 9.3 Critical JetBrains IntelliJ IDEA GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 202…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

JetBrains 4 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.