Read the docs
TI-2021-07840 Aliases CVE-2021-25756GHSA-fm2x-8p52-vp9v

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

Why it matters now

EPSS 0.01314 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*before 2020.2VulnerableJetBrains
  • cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* Versions before 2020.2 Vulnerable ·JetBrains

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25756
  2. 2026-10-03 Alias added: GHSA-fm2x-8p52-vp9v

References

Advisory 1

Other 1

  • TI-2024-24589 Insufficiently protected credentials in JetBrains IntelliJ IDEA CVSS 3.1CRITICAL 9.3
  • TI-2026-46342 In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session CVSS 3.1CRITICAL 10.0
  • TI-2026-46341 In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session CVSS 3.1CRITICAL 10.0
  • TI-2019-07428 In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run… CVSS 3.0CRITICAL 9.8
  • TI-2019-06646 In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the… CVSS 3.0CRITICAL 9.8
  • TI-2020-09382 In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. CVSS 3.1CRITICAL 9.8
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences