Read the docs
TI-2020-06390 Aliases CVE-2020-7906GHSA-h8r4-m8jx-qp8j

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries…

Priority LOW 34CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.

Summary

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

Why it matters now

EPSS 0.00673 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:rider:2019.3.0:*:*:*:*:*:*:*2019.3.0VulnerableJetBrains
  • cpe:2.3:a:jetbrains:rider:2019.3.0:*:*:*:*:*:*:* Versions 2019.3.0 Vulnerable ·JetBrains

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7906
  2. 2026-10-03 Alias added: GHSA-h8r4-m8jx-qp8j

References

Advisory 2

  • TI-2024-24589 Insufficiently protected credentials in JetBrains IntelliJ IDEA CVSS 3.1CRITICAL 9.3
  • TI-2025-17154 In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4… CVSS 3.1HIGH 7.8
  • TI-2019-11158 JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. CVSS 3.1HIGH 7.8
  • TI-2025-27883 In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session CVSS 3.1HIGH 7.5
  • TI-2022-17470 In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution CVSS 3.1HIGH 7.8
  • TI-2025-39859 In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition CVSS 3.1HIGH 7.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences