CVEFinder.io

CVE-2024-37051

⛔ critical
🔍 Scan for this CVE
Summary

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7,

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

CVSS Score
9.3
Critical
EPSS Score
6.3
Exploit Probability
Published Date
2024-06-10
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 88.6% of all 340,405 vulnerabilities in our database.

#38,785
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 11, 2024
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2024-11-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE IDs (Weakness Types)
CWE-522

📦 Affected Products 44

Vendor Product Status Affected Versions
jetbrains intellij_idea Affected
< 2023.1.7
jetbrains intellij_idea Affected
≥ 2023.2.0 < 2023.2.7
jetbrains intellij_idea Affected
≥ 2023.3.0 < 2023.3.7
jetbrains intellij_idea Affected
≥ 2024.1.0 < 2024.1.3
jetbrains rider Affected
< 2023.1.7
jetbrains rider Affected
≥ 2023.2.0 < 2023.2.5
jetbrains rider Affected
≥ 2023.3.0 < 2023.3.6
jetbrains rider Affected
≥ 2024.1.0 < 2024.1.3
jetbrains pycharm Affected
< 2023.1.6
jetbrains pycharm Affected
≥ 2023.2.0 < 2023.2.7
jetbrains pycharm Affected
≥ 2023.3.0 < 2023.3.6
jetbrains pycharm Affected
≥ 2024.1.0 < 2024.1.3
jetbrains mps Affected
< 2023.2.1
jetbrains mps Affected
v2023.3.0
jetbrains goland Affected
< 2023.1.6
jetbrains goland Affected
≥ 2023.2.0 < 2023.2.7
jetbrains goland Affected
≥ 2023.3.0 < 2023.3.7
jetbrains goland Affected
≥ 2024.1.0 < 2024.1.3
jetbrains clion Affected
< 2023.1.7
jetbrains clion Affected
≥ 2023.2.0 < 2023.2.4
jetbrains clion Affected
≥ 2023.3.0 < 2023.3.5
jetbrains clion Affected
≥ 2024.1.0 < 2024.1.3
jetbrains phpstorm Affected
< 2023.1.6
jetbrains phpstorm Affected
≥ 2023.2.0 < 2023.2.6
jetbrains phpstorm Affected
≥ 2023.3.0 < 2023.3.7
jetbrains phpstorm Affected
≥ 2024.1.0 < 2024.1.3
jetbrains rubymine Affected
< 2023.1.7
jetbrains rubymine Affected
≥ 2023.2.0 < 2023.2.7
jetbrains rubymine Affected
≥ 2023.3.0 < 2023.3.7
jetbrains rubymine Affected
≥ 2024.1.0 < 2024.1.3
jetbrains webstorm Affected
< 2023.1.6
jetbrains webstorm Affected
≥ 2023.2.0 < 2023.2.7
jetbrains webstorm Affected
≥ 2023.3.0 < 2023.3.7
jetbrains webstorm Affected
≥ 2024.1.0 < 2024.1.4
jetbrains aqua Affected
< 2024.1.2
jetbrains datagrip Affected
≥ 2023.1.0 < 2023.1.3
jetbrains datagrip Affected
≥ 2023.2.0 < 2023.2.4
jetbrains datagrip Affected
≥ 2023.3.0 < 2023.3.5
jetbrains datagrip Affected
≥ 2024.1.0 < 2024.1.4
jetbrains dataspell Affected
< 2023.1.6
jetbrains dataspell Affected
≥ 2023.2.0 < 2023.2.7
jetbrains dataspell Affected
≥ 2023.3.0 < 2023.3.6
jetbrains dataspell Affected
≥ 2024.1.0 < 2024.1.2
jetbrains rustrover Affected
< 2024.1.1

🔗 References 2

https://security.netapp.com/advisory/ntap-20240705-0...
https://www.jetbrains.com/privacy-security/issues-fi...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-64810 🔶 medium 4.3 0.2 In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activi... 2026-07-23
CVE-2026-64811 ⚠️ high 7.8 0.1 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develop... 2026-07-23
CVE-2026-64812 ⛔ critical 10.0 0.4 In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session 2026-07-23
CVE-2026-64813 ⛔ critical 10.0 0.4 In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session 2026-07-23
CVE-2026-64814 ⚠️ high 8.6 0.3 In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session 2026-07-23
CVE-2026-64815 ⚠️ high 8.1 0.3 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files 2026-07-23
These CVEs affect the same products