Skip to content
Fencer Intel
critical 9.3

CVE-2024-37051 json

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 202…

published 2y ago modified 8d ago also EUVD-2024-36408

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.9%
EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Patch / fix

  • JetBrains IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • JetBrains Aqua 2024.1.2
  • JetBrains CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2, 2024.2_eap2
  • JetBrains DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4
  • JetBrains DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1
  • JetBrains GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • JetBrains MPS 2023.2.1, 2023.3.1, 2024.1 EAP2
  • JetBrains PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3
  • JetBrains PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2
  • JetBrains Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3
  • JetBrains RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4
  • JetBrains RustRover 2024.1.1
  • JetBrains WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
  • jetbrains intellij_idea 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3

Is CVE-2024-37051 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

4.88% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • JetBrains IntelliJ IDEA
  • JetBrains Aqua
  • JetBrains CLion
  • JetBrains DataGrip
  • JetBrains DataSpell
  • JetBrains GoLand
  • JetBrains MPS
  • JetBrains PhpStorm
  • JetBrains PyCharm
  • JetBrains Rider
  • JetBrains RubyMine
  • JetBrains RustRover
  • JetBrains WebStorm
  • jetbrains intellij_idea

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.