CVE-2019-9872: jetbrains intellij_idea
Vulnerability summary
CVE-2019-9872 is a high (CVSS 8.1) vulnerability in jetbrains intellij_idea. EPSS estimates a 1.15% chance of exploitation in the next 30 days, higher than 66.7% of scored vulnerabilities.
Timeline
- 03-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.15%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.15% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Jetbrains1 product
- intellij_idea≥ 2018.1, < 2018.1.8 | ≥ 2018.2, < 2018.2.8 | ≥ 2018.3, < 2018.3.5 | ≥ 2018.3.6, < 2019.1
1 vendor · 1 product
References
1 links- blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/X Refsource CONFIRMVendor Advisory