Vulnerabilities > CVE-2019-10104 - Unspecified vulnerability in Jetbrains Intellij Idea

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

jetbrains

NVD

Published: 2019-07-03

Updated: 2020-08-24

Summary

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

Vulnerable Configurations

Part	Description	Count
Application	Jetbrains Jetbrains Intellij Idea 2018.1 Jetbrains Intellij Idea 2018.1.1 Jetbrains Intellij Idea 2018.1.2 Jetbrains Intellij Idea 2018.1.3 Jetbrains Intellij Idea 2018.1.4 Jetbrains Intellij Idea 2018.1.5 Jetbrains Intellij Idea 2018.1.6 Jetbrains Intellij Idea 2018.1.7 Jetbrains Intellij Idea 2018.2 Jetbrains Intellij Idea 2018.2.1 Jetbrains Intellij Idea 2018.2.2 Jetbrains Intellij Idea 2018.2.3 Jetbrains Intellij Idea 2018.2.4 Jetbrains Intellij Idea 2018.2.5 Jetbrains Intellij Idea 2018.2.6 Jetbrains Intellij Idea 2018.2.7 Jetbrains Intellij Idea 2018.3 Jetbrains Intellij Idea 2018.3.1 Jetbrains Intellij Idea 2018.3.2 Jetbrains Intellij Idea 2018.3.3 Jetbrains Intellij Idea 2018.3.5 Jetbrains Intellij Idea 2018.3.6	22

References

https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/