PT-2020-19836 · Jetbrains · Jetbrains Scala Plugin

Published 2020-02-21 · Updated 2021-07-21 · CVE-2020-7907

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains Scala plugin versions prior to 2019.2.1

Description The issue concerns the resolution of artefact dependencies over unencrypted connections in the JetBrains Scala plugin. This could potentially expose sensitive information.

Recommendations For versions prior to 2019.2.1, update to version 2019.2.1 or later to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-7907

Affected Products

Jetbrains Scala Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-7907 · Security Note
• https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019 · Vendor Advisory
• https://blog.jetbrains.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7907 · Vendor Advisory
• https://t.me/cvenotify/1142 · Telegram Post