// For flags

CVE-2019-9872

 

Severity Score

8.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.

En varias versiones de IntelliJ IDEA Ultimate de JetBrains, la creación de configuraciones de ejecución para servidores de aplicaciones en la nube permite guardar un registro sin cifrar de texto claro de las credenciales del servidor en los archivos de configuración de IDE. Si el complemento de Repositorio de configuración se usó y configuró para sincronizar la configuración de IDE utilizando un repositorio público, estas credenciales se publicaron en este repositorio. El problema se ha solucionado en las siguientes versiones: 2019.1, 2018.3.5, 2018.2.8 y 2018.1.8.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-03-19 CVE Reserved
  • 2019-07-03 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-312: Cleartext Storage of Sensitive Information
  • CWE-522: Insufficiently Protected Credentials
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jetbrains
Search vendor "Jetbrains"
 Intellij Idea
Search vendor "Jetbrains" for product "Intellij Idea"
 >= 2018.1 < 2018.1.8
Search vendor "Jetbrains" for product "Intellij Idea" and version " >= 2018.1 < 2018.1.8"
-
Affected
Jetbrains
Search vendor "Jetbrains"
 Intellij Idea
Search vendor "Jetbrains" for product "Intellij Idea"
 >= 2018.2 < 2018.2.8
Search vendor "Jetbrains" for product "Intellij Idea" and version " >= 2018.2 < 2018.2.8"
-
Affected
Jetbrains
Search vendor "Jetbrains"
 Intellij Idea
Search vendor "Jetbrains" for product "Intellij Idea"
 >= 2018.3 < 2018.3.5
Search vendor "Jetbrains" for product "Intellij Idea" and version " >= 2018.3 < 2018.3.5"
-
Affected
Jetbrains
Search vendor "Jetbrains"
 Intellij Idea
Search vendor "Jetbrains" for product "Intellij Idea"
 >= 2018.3.6 < 2019.1
Search vendor "Jetbrains" for product "Intellij Idea" and version " >= 2018.3.6 < 2019.1"
-
Affected