CVE-2024-37051
Description
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4
How to fix
- jetbrains aqua2024.1.2 or later
- jetbrains clion2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3 or later
- jetbrains datagrip2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4 or later
- jetbrains dataspell2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2 or later
- jetbrains goland2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3 or later
- jetbrains intellij_idea2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3 or later
- jetbrains mps2023.2.1 or later
- jetbrains phpstorm2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3 or later
- jetbrains pycharm2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3 or later
- jetbrains rider2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3 or later
- jetbrains rubymine2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3 or later
- jetbrains rustrover2024.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jetbrains aqua | v < 2024.1.2 | 2024.1.2 |
| jetbrains clion | v < 2023.1.7, 2023.2.0 ≤ v < 2023.2.4, 2023.3.0 ≤ v < 2023.3.5, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3 |
| jetbrains datagrip | 2023.1.0 ≤ v < 2023.1.3, 2023.2.0 ≤ v < 2023.2.4, 2023.3.0 ≤ v < 2023.3.5, 2024.1.0 ≤ v < 2024.1.4 | 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4 |
| jetbrains dataspell | v < 2023.1.6, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.6, 2024.1.0 ≤ v < 2024.1.2 | 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2 |
| jetbrains goland | v < 2023.1.6, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.7, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3 |
| jetbrains intellij_idea | v < 2023.1.7, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.7, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3 |
| jetbrains mps | v < 2023.2.1, 2023.3.0 | 2023.2.1 |
| jetbrains phpstorm | v < 2023.1.6, 2023.2.0 ≤ v < 2023.2.6, 2023.3.0 ≤ v < 2023.3.7, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3 |
| jetbrains pycharm | v < 2023.1.6, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.6, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3 |
| jetbrains rider | v < 2023.1.7, 2023.2.0 ≤ v < 2023.2.5, 2023.3.0 ≤ v < 2023.3.6, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3 |
| jetbrains rubymine | v < 2023.1.7, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.7, 2024.1.0 ≤ v < 2024.1.3 | 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3 |
| jetbrains rustrover | v < 2024.1.1 | 2024.1.1 |
| jetbrains webstorm | v < 2023.1.6, 2023.2.0 ≤ v < 2023.2.7, 2023.3.0 ≤ v < 2023.3.7, 2024.1.0 ≤ v < 2024.1.4 | 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.