Vulnerability in Jetbrains Aqua
CVE-2024-37051
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3…
EPSS: 0.063 (91.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Jetbrains Aqua — versions 0
- Jetbrains Clion — versions 2023.1
- Jetbrains Datagrip — versions 2023.1
- Jetbrains Dataspell — versions 2023.1
- Jetbrains Goland — versions 2023.1
- Jetbrains Intellij Idea — versions 2023.1
- Jetbrains Mps — versions 2023.1
- Jetbrains Phpstorm — versions 2023.1
- Jetbrains Pycharm — versions 2023.1
- Jetbrains Rider — versions 2023.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-37051?
- CVE-2024-37051 is a critical-severity vulnerability in Jetbrains Aqua, classified under Insufficiently Protected Credentials. CVSS score: 9.3/10. Published 2024-06-10.
- How severe is CVE-2024-37051?
- Critical severity. CVSS v3 base score is 9.3 out of 10.
- Is CVE-2024-37051 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.