PT-2019-12666 · Jetbrains · Jetbrains Upsource

Published 2019-10-02 · Updated 2021-01-26 · CVE-2019-12157

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains UpSource versions prior to 2018.2 build 1293

Description The issue concerns credential disclosure through RPC commands, potentially allowing unauthorized access to sensitive information.

Recommendations For versions prior to 2018.2 build 1293, update to a version that includes the fix for this issue, specifically 2018.2 build 1293 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-12157

Affected Products

Jetbrains Upsource

References · 3

• https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12157 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12157 · Vendor Advisory