PT-2019-11567 · Jetbrains+4 · Intellij Idea Ultimate+4

Jonathan Leitschuh · Publicado 2019-07-03 · Atualizado 2020-08-24 · CVE-2019-10104

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA Ultimate versions prior to 2018.3.4 JetBrains IntelliJ IDEA Ultimate versions prior to 2018.2.8 JetBrains IntelliJ IDEA Ultimate versions prior to 2018.1.8 JetBrains IntelliJ IDEA Ultimate versions prior to 2017.3.7

Description: The issue allows a remote attacker to execute code when an Application Server run configuration is running, because a JMX server listened on all interfaces instead of localhost only. This affects configurations for Tomcat, Jetty, Resin, or CloudBees.

Recommendations: For versions prior to 2018.3.4, update to version 2018.3.4 or later. For versions prior to 2018.2.8, update to version 2018.2.8 or later. For versions prior to 2018.1.8, update to version 2018.1.8 or later. For versions prior to 2017.3.7, update to version 2017.3.7 or later.

Correção

Identificadores relacionados

CVE-2019-10104

Produtos afetados

Cloudbees

Intellij Idea Ultimate

Jetty

Resin

Apache Tomcat

Referências · 8

• https://t.me/cvenotify/198 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-10104 · Nota de Segurança
• https://t.me/cvenotify/254 · Publicação no Telegram
• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10104 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-10104 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10104 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-10104 · Nota de Segurança