PT-2019-19876 · Jetbrains · Intellij Idea

Published 2019-07-03 · Updated 2020-08-24 · CVE-2019-9823

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2018.3.5 JetBrains IntelliJ IDEA versions prior to 2018.2.8 JetBrains IntelliJ IDEA versions prior to 2018.1.8

Description The issue arises when creating remote run configurations of JavaEE application servers in JetBrains IntelliJ IDEA, resulting in the storage of server credentials in cleartext within the IDE configuration files.

Recommendations For versions prior to 2018.3.5, update to version 2018.3.5 or later. For versions prior to 2018.2.8, update to version 2018.2.8 or later. For versions prior to 2018.1.8, update to version 2018.1.8 or later.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

CVE-2019-9823

Affected Products

Intellij Idea

References · 8

• https://ubuntu.com/security/CVE-2019-9823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9823 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-9823 · Security Note
• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9823 · Vendor Advisory
• https://t.me/cvenotify/250 · Telegram Post
• https://t.me/cvenotify/194 · Telegram Post