Jetbrains Intellij Idea vulnerabilities, page 3
82 vulnerabilities
Known vulnerabilities in Jetbrains Intellij Idea, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-24346jetbrainsintellij_idea
EPSS score0.43%
In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.CVE-2022-28651jetbrainsintellij_ideaEPSS score0.32%
In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fieldsCVE-2017-8316jetbrainsintellij_ideaEPSS score2.26%
IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml.CVE-2024-37051jetbrainsaqua+12EPSS score4.88%
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4CVE-2024-46970jetbrainsintellij_ideaEPSS score0.39%
In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possibleCVE-2024-24940jetbrainsintellij_ideaEPSS score0.27%
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesCVE-2024-24941jetbrainsintellij_ideaEPSS score0.32%
In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URLCVE-2019-9873ubuntuintellij-community-idea+1EPSS score1.56%
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.CVE-2019-9872jetbrainsintellij_ideaEPSS score1.15%
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.CVE-2019-9186ubuntuintellij-community-idea+1EPSS score4.51%
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.CVE-2019-9823ubuntuintellij-community-idea+1EPSS score1.57%
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8.CVE-2019-14954ubuntuintellij-community-idea+1EPSS score0.70%
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.CVE-2019-18361ubuntuintellij-community-idea+1EPSS score0.38%
JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.CVE-2019-10104ubuntuintellij-community-idea+1EPSS score3.81%
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.CVE-2026-59792jetbrainsintellij_ideaEPSS score0.60%
In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possibleCVE-2026-86501jetbrainsintellij_ideaEPSS score0.39%
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logCVE-2026-86504jetbrainsintellij_ideaEPSS score0.18%
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executionCVE-2026-86505jetbrainsintellij_ideaEPSS score0.15%
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplaceCVE-2026-86502jetbrainsintellij_ideaEPSS score0.21%
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hostsCVE-2026-86503jetbrainsintellij_ideaEPSS score0.14%
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching