Google · Android Studio · CVE-2024-5899
Name of the Vulnerable Software and Affected Versions:
Bazel Plugin versions prior to 2024.06.04.0.2
Description:
The issue arises when the Bazel Plugin in IntelliJ imports a project, either using "import project" or "Auto import", and the dialog for trusting the project is not displayed. This occurs because both methods call `ProjectBuilder.createProject`, which then calls `ProjectManager.getInstance().createProject`, a method intended for creating new projects, not importing existing ones.
Recommendations:
For versions prior to 2024.06.04.0.2, upgrade to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion, and Android Studio Bazel plugins.