Vulnerability Intelligence Report

CVE-2024-37051

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

No Active Exploit Signals

CVSS Base Score

9.3

CRITICAL

Exploitability:2.9

Impact Score:5.8

EPSS Probability:3.84%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

CWE-522 ↗CWE-522: Insufficiently Protected Credentials

Affected Products & Versions

Vendor	Product	Affected Versions
JetBrains	IntelliJ IDEA	2023.1 < 2023.1.7 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.7 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP3 (affected)
JetBrains	Aqua	0 < 2024.1.2 (affected)
JetBrains	CLion	2023.1 < 2023.1.7 (affected), 2023.1 < 2023.2.4 (affected), 2023.1 < 2023.3.5 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP2 (affected)
JetBrains	DataGrip	2023.1 < 2023.1.3 (affected), 2023.1 < 2023.2.4 (affected), 2023.1 < 2023.3.5 (affected), 2023.1 < 2024.1.4 (affected)
JetBrains	DataSpell	2023.1 < 2023.1.6 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.6 (affected), 2023.1 < 2024.1.2 (affected), 2023.1 < 2024.2 EAP1 (affected)
JetBrains	GoLand	2023.1 < 2023.1.6 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.7 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP3 (affected)
JetBrains	MPS	2023.1 < 2023.2.1 (affected), 2023.1 < 2023.3.1 (affected), 2023.1 < 2024.1 EAP2 (affected)
JetBrains	PhpStorm	2023.1 < 2023.1.6 (affected), 2023.1 < 2023.2.6 (affected), 2023.1 < 2023.3.7 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP3 (affected)
JetBrains	PyCharm	2023.1 < 2023.1.6 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.6 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP2 (affected)
JetBrains	Rider	2023.1 < 2023.1.7 (affected), 2023.1 < 2023.2.5 (affected), 2023.1 < 2023.3.6 (affected), 2023.1 < 2024.1.3 (affected)
JetBrains	RubyMine	2023.1 < 2023.1.7 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.7 (affected), 2023.1 < 2024.1.3 (affected), 2023.1 < 2024.2 EAP4 (affected)
JetBrains	RustRover	0 < 2024.1.1 (affected)
JetBrains	WebStorm	2023.1 < 2023.1.6 (affected), 2023.1 < 2023.2.7 (affected), 2023.1 < 2023.3.7 (affected), 2023.1 < 2024.1.4 (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

3.837%

GitHub Advisory

GHSA-vfg9-hgrq-rjhq ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	JetBrains s.r.o. · Vendor · Czech Republic
Reserved	2024-05-31T14:05:53
Published	2024-06-10T15:58:06
Last Updated	2025-02-13T17:52:58

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2024-37051

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2024-37051

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE