PT-2024-6311 · Jetbrains · Jetbrains Intellij Idea

Published 2024-09-16 · Updated 2024-09-20 · CVE-2024-46970

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2024.1

Description The issue is related to the lack of protection of the web page structure in the integrated development environment, allowing for HTML injection via the project name. This could enable an attacker to implement cross-site scripting attacks, potentially leading to malicious script injection.

Recommendations For versions prior to 2024.1, upgrade the affected component to the latest version to patch the issue. As a temporary workaround, consider restricting the use of project names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-07262

CVE-2024-46970

Affected Products

Jetbrains Intellij Idea

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-46970 · Security Note
• https://bdu.fstec.ru/vul/2024-07262 · Security Note
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-46970 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1835657390160539834 · Twitter Post
• https://t.me/cvedetector/5718 · Telegram Post
• https://t.me/cvenotify/95421 · Telegram Post
• https://twitter.com/oktsec/status/1835653436475314513 · Twitter Post
• https://twitter.com/CVEnew/status/1835630404516331952 · Twitter Post
• https://t.me/cvenotify/94704 · Telegram Post