PT-2019-19906 · Jetbrains · Settings Repository Plugin+1

Published 2019-07-03 · Updated 2020-08-24 · CVE-2019-9872

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA Ultimate versions prior to 2019.1 JetBrains IntelliJ IDEA Ultimate version 2018.3 before 2018.3.5 JetBrains IntelliJ IDEA Ultimate version 2018.2 before 2018.2.8 JetBrains IntelliJ IDEA Ultimate version 2018.1 before 2018.1.8

Description The issue arises when creating run configurations for cloud application servers in JetBrains IntelliJ IDEA Ultimate, resulting in the storage of server credentials in cleartext within the IDE configuration files. If the Settings Repository plugin is used to synchronize IDE settings via a public repository, these credentials are then published to the repository.

Recommendations For versions prior to 2019.1, update to version 2019.1 or later. For version 2018.3, update to version 2018.3.5 or later. For version 2018.2, update to version 2018.2.8 or later. For version 2018.1, update to version 2018.1.8 or later.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

CVE-2019-9872

Affected Products

Intellij Idea Ultimate

Settings Repository Plugin

References · 5

• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9872 · Security Note
• https://t.me/cvenotify/195 · Telegram Post
• https://t.me/cvenotify/251 · Telegram Post