Jetbrains Intellij Idea vulnerabilities
82 vulnerabilities
Known vulnerabilities in Jetbrains Intellij Idea, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-25758jetbrainsintellij_idea
EPSS score0.96%
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.CVE-2021-25756jetbrainsintellij_ideaEPSS score1.30%
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.CVE-2021-29263jetbrainsintellij_ideaEPSS score0.46%
In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.CVE-2021-45977jetbrainsclion+6EPSS score1.08%
JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1.CVE-2021-30504jetbrainsintellij_ideaEPSS score2.31%
In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.CVE-2021-30006jetbrainsintellij_ideaEPSS score1.07%
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.CVE-2025-68269jetbrainsintellij_ideaEPSS score0.11%
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSHCVE-2025-57727jetbrainsintellij_ideaEPSS score0.20%
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote referenceCVE-2025-57728jetbrainsintellij_ideaEPSS score0.25%
In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden filesCVE-2025-57730jetbrainsintellij_ideaEPSS score0.43%
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureCVE-2025-57729jetbrainsintellij_ideaEPSS score0.13%
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server startCVE-2025-32054jetbrainsintellij_ideaEPSS score0.43%
In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileCVE-2020-11690ubuntuintellij-community-idea+1EPSS score2.30%
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.CVE-2020-7905ubuntuintellij-community-idea+1EPSS score1.16%
Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.CVE-2020-7904ubuntuintellij-community-idea+1EPSS score1.42%
In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.CVE-2020-7914ubuntuintellij-community-idea+1EPSS score1.89%
In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.CVE-2020-27622jetbrainsintellij_ideaEPSS score1.31%
In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.CVE-2022-40978jetbrainsintellij_ideaEPSS score0.26%
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-47895jetbrainsintellij_ideaEPSS score0.22%
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.CVE-2022-47896jetbrainsintellij_ideaEPSS score0.26%
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.