PT-2024-1694 · Jetbrains · Jetbrains Intellij Idea

Published 2024-02-06 · Updated 2024-02-09 · CVE-2024-24941

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2023.3.3

Description The issue exists due to insufficient input validation in the authentication token handler component of the integrated development environment. This could allow a remote attacker to send an authentication token to an arbitrary URL.

Recommendations For versions prior to 2023.3.3, update to version 2023.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin for JetBrains Space until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-01382

CVE-2024-24941

Affected Products

Jetbrains Intellij Idea

References · 8

• https://osv.dev/vulnerability/CVE-2024-24941 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24941 · Security Note
• https://bdu.fstec.ru/vul/2024-01382 · Security Note
• https://twitter.com/CVEnew/status/1754805420567532006 · Twitter Post
• https://twitter.com/RedPacketSec/status/1755895752864182453 · Twitter Post
• https://t.me/cvenotify/70192 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1754833969156141445 · Twitter Post