CVE-2024-5899
Low
Description
When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins.
SeverityLow
CVSS3.3
Exploit probability—
Product
Google Bazel For Android Studio
PublishedJun 18, 2024
First seenJun 18, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- google bazel_for_android_studio2024.06.04.0.2 or later
- google bazel_for_clion2024.06.04.0.2 or later
- google bazel_for_intellij2024.06.04.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google bazel_for_android_studio | v < 2024.06.04.0.2 | 2024.06.04.0.2 |
| google bazel_for_clion | v < 2024.06.04.0.2 | 2024.06.04.0.2 |
| google bazel_for_intellij | v < 2024.06.04.0.2 | 2024.06.04.0.2 |
| github.com/bazelbuild/intellijGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.