PT-2019-11567 · Jetbrains+4 · Intellij Idea Ultimate+4

Jonathan Leitschuh · Published 2019-07-03 · Updated 2020-08-24 · CVE-2019-10104

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA Ultimate versions prior to 2018.3.4 JetBrains IntelliJ IDEA Ultimate versions prior to 2018.2.8 JetBrains IntelliJ IDEA Ultimate versions prior to 2018.1.8 JetBrains IntelliJ IDEA Ultimate versions prior to 2017.3.7

Description: The issue allows a remote attacker to execute code when an Application Server run configuration is running, because a JMX server listened on all interfaces instead of localhost only. This affects configurations for Tomcat, Jetty, Resin, or CloudBees.

Recommendations: For versions prior to 2018.3.4, update to version 2018.3.4 or later. For versions prior to 2018.2.8, update to version 2018.2.8 or later. For versions prior to 2018.1.8, update to version 2018.1.8 or later. For versions prior to 2017.3.7, update to version 2017.3.7 or later.

Fix

Related Identifiers

CVE-2019-10104

Affected Products

Cloudbees

Intellij Idea Ultimate

Jetty

Resin

Apache Tomcat

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-10104 · Security Note
• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10104 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10104 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10104 · Security Note
• https://t.me/cvenotify/198 · Telegram Post
• https://t.me/cvenotify/254 · Telegram Post