Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-37051

Quick assessment

Affected
JetBrains IntelliJ IDEA
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

JetBrains IntelliJ IDEA等都是捷克JetBrains公司的产品。JetBrains IntelliJ IDEA是一套适用于Java语言的集成开发环境。JetBrains PyCharm是一款针对Python语言的集成开发环境（IDE）。JetBrains PhpStorm是一个应用软件。 JetBrains多个产品存在安全漏洞，该漏洞源于GitHub访问令牌可能会暴露给第三方网站。以下产品受到影响：JetBrains IntelliJ IDEA、Aqua、CLion、DataGrip

CVSS 9.3 · Critical EPSS 3.84% · P90
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-37051

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
JetBrains 多款集成开发环境安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
JetBrains IntelliJ IDEA等都是捷克JetBrains公司的产品。JetBrains IntelliJ IDEA是一套适用于Java语言的集成开发环境。JetBrains PyCharm是一款针对Python语言的集成开发环境（IDE）。JetBrains PhpStorm是一个应用软件。 JetBrains多个产品存在安全漏洞，该漏洞源于GitHub访问令牌可能会暴露给第三方网站。以下产品受到影响：JetBrains IntelliJ IDEA、Aqua、CLion、DataGrip
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
JetBrains IntelliJ IDEA 2023.1 ~ 2023.1.7 -
JetBrains Aqua 0 ~ 2024.1.2 -
JetBrains CLion 2023.1 ~ 2023.1.7 -
JetBrains DataGrip 2023.1 ~ 2023.1.3 -
JetBrains DataSpell 2023.1 ~ 2023.1.6 -
JetBrains GoLand 2023.1 ~ 2023.1.6 -
JetBrains MPS 2023.1 ~ 2023.2.1 -
JetBrains PhpStorm 2023.1 ~ 2023.1.6 -
JetBrains PyCharm 2023.1 ~ 2023.1.6 -
JetBrains Rider 2023.1 ~ 2023.1.7 -
JetBrains RubyMine 2023.1 ~ 2023.1.7 -
JetBrains RustRover 0 ~ 2024.1.1 -
JetBrains WebStorm 2023.1 ~ 2023.1.6 -

II. Public POCs for CVE-2024-37051

# POC Description Source Link Shenlong Link
1 CVE-2024-37051 poc and exploit https://github.com/LeadroyaL/CVE-2024-37051-EXP POC Details
2 Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051) https://github.com/mrblackstar26/CVE-2024-37051 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-37051

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-37051 (1)

Vendor Pages for CVE-2024-37051 (1)

IV. Related Vulnerabilities

Same product: IntelliJ IDEA
Same vendor: JetBrains
Same weakness: CWE-522

V. Comments for CVE-2024-37051

No comments yet

Leave a comment