PT-2025-4868 · Jetbrains · Dottrace+2

Published 2025-01-28 · Updated 2025-01-28 · CVE-2025-23385

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains ReSharper versions prior to 2024.3.4 JetBrains Rider versions prior to 2024.3.4 dotTrace versions prior to 2024.3.4 ETW Host Service versions prior to 16.43

Description The issue is related to incorrect process management in the affected software, which can allow an attacker to escalate their privileges. This can be achieved through the ETW Host Service.

Recommendations For JetBrains ReSharper versions prior to 2024.3.4, update to version 2024.3.4 or later. For JetBrains Rider versions prior to 2024.3.4, update to version 2024.3.4 or later. For dotTrace versions prior to 2024.3.4, update to version 2024.3.4 or later. For ETW Host Service versions prior to 16.43, update to version 16.43 or later.

Fix

LPE

Weakness Enumeration

CWE-114

Related Identifiers

BDU:2025-01325

CVE-2025-23385

Affected Products

Resharper

Rider

Dottrace

References · 8

• https://osv.dev/vulnerability/CVE-2025-23385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23385 · Security Note
• https://bdu.fstec.ru/vul/2025-01325 · Security Note
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://t.me/cvedetector/16610 · Telegram Post
• https://twitter.com/CVEnew/status/1884274376930939127 · Twitter Post
• https://vuldb.com/?id.293933 · Note
• https://twitter.com/VulmonFeeds/status/1884290181139698065 · Twitter Post