The vulnerability of the JetBrains plugin for GitHub-integrated development environments for software such as JetBrains Aqua, CLion, DataGrip, DataSpell, GoLand, IntelliJ IDEA, MPS, PhpStorm, PyCharm, Rider, RubyMine, RustRover, and WebStorm allows attackers to escalate their privileges.

🗓️ 13 Jun 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

JetBrains GitHub IDE plugin flaw enables privilege escalation via exposed registration data.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for Insufficiently Protected Credentials in Jetbrains Aqua	11 Jun 202416:01	–	githubexploit
Circl	CVE-2024-37051	11 Jun 202416:07	–	circl
CNNVD	JetBrains Multiple IDE Security Vulnerabilities	10 Jun 202400:00	–	cnnvd
CVE	CVE-2024-37051	10 Jun 202415:58	–	cve
Cvelist	CVE-2024-37051	10 Jun 202415:58	–	cvelist
EUVD	EUVD-2024-36408	3 Oct 202520:07	–	euvd
NVD	CVE-2024-37051	10 Jun 202416:15	–	nvd
Positive Technologies	PT-2024-4040 · Jetbrains · Mps +12	10 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-37051	5 Feb 202500:37	–	redhatcve
Vulnrichment	CVE-2024-37051	10 Jun 202415:58	–	vulnrichment

Vulners

Node

jetbrains aquaRange<2024.1.2

OR

jetbrains clionRange<2023.1.7

OR

jetbrains clionRange2023.2.0–2023.2.4

OR

jetbrains clionRange2023.3.0–2023.3.5

OR

jetbrains clionRange2024.1.0–2024.1.3

OR

jetbrains datagripRange2023.1.0–2023.1.3

OR

jetbrains datagripRange2023.2.0–2023.2.4

OR

jetbrains datagripRange2023.3.0–2023.3.5

OR

jetbrains datagripRange2024.1.0–2024.1.4

OR

jetbrains dataspellRange<2023.1.6

OR

jetbrains dataspellRange2023.2.0–2023.2.7

OR

jetbrains dataspellRange2023.3.0–2023.3.6

OR

jetbrains dataspellRange2024.1.0–2024.1.2

OR

jetbrains golandRange<2023.1.6

OR

jetbrains golandRange2023.2.0–2023.2.7

OR

jetbrains golandRange2023.3.0–2023.3.7

OR

jetbrains golandRange2024.1.0–2024.1.3

OR

jetbrains intellij_ideaRange<2023.1.7

OR

jetbrains intellij_ideaRange2023.2.0–2023.2.7

OR

jetbrains intellij_ideaRange2023.3.0–2023.3.7

OR

jetbrains intellij_ideaRange2024.1.0–2024.1.3

OR

jetbrains mpsRange<2023.2.1

OR

jetbrains mpsMatch2023.3.0

OR

jetbrains phpstormRange<2023.1.6

OR

jetbrains phpstormRange2023.2.0–2023.2.6

OR

jetbrains phpstormRange2023.3.0–2023.3.7

OR

jetbrains phpstormRange2024.1.0–2024.1.3

OR

jetbrains pycharmRange<2023.1.6

OR

jetbrains pycharmRange2023.2.0–2023.2.7

OR

jetbrains pycharmRange2023.3.0–2023.3.6

OR

jetbrains pycharmRange2024.1.0–2024.1.3

OR

jetbrains riderRange<2023.1.7

OR

jetbrains riderRange2023.2.0–2023.2.5

OR

jetbrains riderRange2023.3.0–2023.3.6

OR

jetbrains riderRange2024.1.0–2024.1.3

OR

jetbrains rubymineRange<2023.1.7

OR

jetbrains rubymineRange2023.2.0–2023.2.7

OR

jetbrains rubymineRange2023.3.0–2023.3.7

OR

jetbrains rubymineRange2024.1.0–2024.1.3

OR

jetbrains rustroverRange<2024.1.1

OR

jetbrains webstormRange<2023.1.6

OR

jetbrains webstormRange2023.2.0–2023.2.7

OR

jetbrains webstormRange2023.3.0–2023.3.7

OR

jetbrains webstormRange2024.1.0–2024.1.4

Source	Link
jetbrains	www.jetbrains.com/privacy-security/issues-fixed/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Jun 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 39.3

CVSS 29.4

EPSS0.06318

JetBrains GitHub environments Privilege escalation Registration data Access tokens