Read the docs
TI-2024-24589 Aliases CVE-2024-37051GHSA-vfg9-hgrq-rjhq

Insufficiently protected credentials in JetBrains IntelliJ IDEA

Priority HIGH 75CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04883 92nd percentileScored 2026-11-07
Fix Fixed IntelliJ IDEA (JetBrains): 2023.1.7, 2023.2.7, 2023.3.7 +2Aqua (JetBrains): 2024.1.2+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsIntelliJ IDEA2023.1 to before 2023.1.7; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP32023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3Patch availableCNA
JetBrainsAquabefore 2024.1.22024.1.2Patch availableCNA
JetBrainsCLion2023.1 to before 2023.1.7; 2023.1 to before 2023.2.4; 2023.1 to before 2023.3.5; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP22023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2Patch availableCNA
JetBrainsDataGrip2023.1 to before 2023.1.3; 2023.1 to before 2023.2.4; 2023.1 to before 2023.3.5; 2023.1 to before 2024.1.42023.1.3, 2023.2.4, 2023.3.5, 2024.1.4Patch availableCNA
JetBrainsDataSpell2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.2; 2023.1 to before 2024.2 EAP12023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1Patch availableCNA
JetBrainsGoLand2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP32023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3Patch availableCNA
JetBrainsMPS2023.1 to before 2023.2.1; 2023.1 to before 2023.3.1; 2023.1 to before 2024.1 EAP22023.2.1, 2023.3.1, 2024.1 EAP2Patch availableCNA
JetBrainsPhpStorm2023.1 to before 2023.1.6; 2023.1 to before 2023.2.6; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP32023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3Patch availableCNA
JetBrainsPyCharm2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP22023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2Patch availableCNA
JetBrainsRider2023.1 to before 2023.1.7; 2023.1 to before 2023.2.5; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.32023.1.7, 2023.2.5, 2023.3.6, 2024.1.3Patch availableCNA
JetBrainsRubyMine2023.1 to before 2023.1.7; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP42023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4Patch availableCNA
JetBrainsRustRoverbefore 2024.1.12024.1.1Patch availableCNA
JetBrainsWebStorm2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.42023.1.6, 2023.2.7, 2023.3.7, 2024.1.4Patch availableCNA
  • IntelliJ IDEA VendorJetBrains Affected 2023.1 to before 2023.1.7; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP3 Fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3 Patch available CNA
  • Aqua VendorJetBrains Affected before 2024.1.2 Fixed in 2024.1.2 Patch available CNA
  • CLion VendorJetBrains Affected 2023.1 to before 2023.1.7; 2023.1 to before 2023.2.4; 2023.1 to before 2023.3.5; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP2 Fixed in 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2 Patch available CNA
  • DataGrip VendorJetBrains Affected 2023.1 to before 2023.1.3; 2023.1 to before 2023.2.4; 2023.1 to before 2023.3.5; 2023.1 to before 2024.1.4 Fixed in 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4 Patch available CNA
  • DataSpell VendorJetBrains Affected 2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.2; 2023.1 to before 2024.2 EAP1 Fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1 Patch available CNA
  • GoLand VendorJetBrains Affected 2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP3 Fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3 Patch available CNA
  • MPS VendorJetBrains Affected 2023.1 to before 2023.2.1; 2023.1 to before 2023.3.1; 2023.1 to before 2024.1 EAP2 Fixed in 2023.2.1, 2023.3.1, 2024.1 EAP2 Patch available CNA
  • PhpStorm VendorJetBrains Affected 2023.1 to before 2023.1.6; 2023.1 to before 2023.2.6; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP3 Fixed in 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3 Patch available CNA
  • PyCharm VendorJetBrains Affected 2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP2 Fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2 Patch available CNA
  • Rider VendorJetBrains Affected 2023.1 to before 2023.1.7; 2023.1 to before 2023.2.5; 2023.1 to before 2023.3.6; 2023.1 to before 2024.1.3 Fixed in 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3 Patch available CNA
  • RubyMine VendorJetBrains Affected 2023.1 to before 2023.1.7; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.3; 2023.1 to before 2024.2 EAP4 Fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4 Patch available CNA
  • RustRover VendorJetBrains Affected before 2024.1.1 Fixed in 2024.1.1 Patch available CNA
  • WebStorm VendorJetBrains Affected 2023.1 to before 2023.1.6; 2023.1 to before 2023.2.7; 2023.1 to before 2023.3.7; 2023.1 to before 2024.1.4 Fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:aqua:*:*:*:*:*:*:*:*before 2024.1.2VulnerableJetBrains
cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:*before 2023.1.7; 2023.2.0 to before 2023.2.4; 2023.3.0 to before 2023.3.5; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:*2023.1.0 to before 2023.1.3; 2023.2.0 to before 2023.2.4; 2023.3.0 to before 2023.3.5; 2024.1.0 to before 2024.1.4VulnerableJetBrains
cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:*before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.2VulnerableJetBrains
cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:*before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*before 2023.1.7; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:mps:*:*:*:*:*:*:*:*before 2023.2.1VulnerableJetBrains
cpe:2.3:a:jetbrains:mps:2023.3.0:*:*:*:*:*:*:*2023.3.0VulnerableJetBrains
cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:*before 2023.1.6; 2023.2.0 to before 2023.2.6; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.3VulnerableJetBrains
  • cpe:2.3:a:jetbrains:aqua:*:*:*:*:*:*:*:* Versions before 2024.1.2 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:clion:*:*:*:*:*:*:*:* Versions before 2023.1.7; 2023.2.0 to before 2023.2.4; 2023.3.0 to before 2023.3.5; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:datagrip:*:*:*:*:*:*:*:* Versions 2023.1.0 to before 2023.1.3; 2023.2.0 to before 2023.2.4; 2023.3.0 to before 2023.3.5; 2024.1.0 to before 2024.1.4 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:dataspell:*:*:*:*:*:*:*:* Versions before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.2 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:goland:*:*:*:*:*:*:*:* Versions before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* Versions before 2023.1.7; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:mps:*:*:*:*:*:*:*:* Versions before 2023.2.1 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:mps:2023.3.0:*:*:*:*:*:*:* Versions 2023.3.0 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:phpstorm:*:*:*:*:*:*:*:* Versions before 2023.1.6; 2023.2.0 to before 2023.2.6; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:* Versions before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*before 2023.1.7; 2023.2.0 to before 2023.2.5; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:*before 2023.1.7; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3VulnerableJetBrains
cpe:2.3:a:jetbrains:rustrover:*:*:*:*:*:*:*:*before 2024.1.1VulnerableJetBrains
cpe:2.3:a:jetbrains:webstorm:*:*:*:*:*:*:*:*before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.4VulnerableJetBrains
  • cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:* Versions before 2023.1.7; 2023.2.0 to before 2023.2.5; 2023.3.0 to before 2023.3.6; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:rubymine:*:*:*:*:*:*:*:* Versions before 2023.1.7; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.3 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:rustrover:*:*:*:*:*:*:*:* Versions before 2024.1.1 Vulnerable ·JetBrains
  • cpe:2.3:a:jetbrains:webstorm:*:*:*:*:*:*:*:* Versions before 2023.1.6; 2023.2.0 to before 2023.2.7; 2023.3.0 to before 2023.3.7; 2024.1.0 to before 2024.1.4 Vulnerable ·JetBrains

Remediation

  • Fix · CNA IntelliJ IDEA (JetBrains) Fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • Fix · CNA Aqua (JetBrains) Fixed in 2024.1.2
  • Fix · CNA CLion (JetBrains) Fixed in 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2
  • Fix · CNA DataGrip (JetBrains) Fixed in 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4
  • Fix · CNA DataSpell (JetBrains) Fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1
  • Fix · CNA GoLand (JetBrains) Fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • Fix · CNA MPS (JetBrains) Fixed in 2023.2.1, 2023.3.1, 2024.1 EAP2
  • Fix · CNA PhpStorm (JetBrains) Fixed in 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • Fix · CNA PyCharm (JetBrains) Fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2
  • Fix · CNA Rider (JetBrains) Fixed in 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3
  • Fix · CNA RubyMine (JetBrains) Fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4
  • Fix · CNA RustRover (JetBrains) Fixed in 2024.1.1
  • Fix · CNA WebStorm (JetBrains) Fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37051
  2. 2026-10-03 Alias added: GHSA-vfg9-hgrq-rjhq
  3. 2026-10-07 EPSS moved to the 90th–95th percentile
  4. 2026-11-03 CISA SSVC decision points changed

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences