BDU:2024-04477CriticalConfirmedExploit available
BDU
BDU
Data Bank of Information Security Threats
BDU ФСТЭК is the authoritative Russian source of vulnerability information, covering both international CVEs relevant to domestic software and unique Russian-disclosed issues. Entries contain severity, affected product lists (in Russian), and mitigation recommendations.
Region
RU
Updates
1 ч
License
Открытые данные
Russian federal catalog of vulnerabilities and threats maintained by FSTEC. Required for compliance with Russian information security regulations (Приказ №17, Приказ №21).
https://bdu.fstec.ru →Share link
Anyone with the link can open this vulnerability.
Уязвимость плагина JetBrains GitHub интегрированных сред разработки программного обеспечения JetBrains Aqua, CLion, DataGrip, DataSpell, Go…
CVSS
9.3
Critical
EPSS
0.00
p0
Published
2024-01-01
Updated
2024-01-01
Description
Уязвимость плагина JetBrains GitHub интегрированных сред разработки программного обеспечения JetBrains Aqua, CLion, DataGrip, DataSpell, GoLand, IntelliJ IDEA, MPS, PhpStorm, PyCharm, Rider, RubyMine, RustRover, WebStorm связана с недостаточной защитой регистрационных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, повысить свои привилегии путём получения токена доступа
Tags · CWE
Pre-auth
Affected products
Jetbrains AquaJetbrains ClionJetbrains ClionJetbrains ClionJetbrains ClionJetbrains DatagripJetbrains DatagripJetbrains DatagripJetbrains DatagripJetbrains DataspellJetbrains DataspellJetbrains DataspellJetbrains DataspellJetbrains GolandJetbrains GolandJetbrains GolandJetbrains GolandJetbrains Intellij ideaJetbrains Intellij ideaJetbrains Intellij idea
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Timeline
2024-01-01
Published
2024-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: R
Required (R)
Scope
S: C
Changed (C)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: N
None (N)
Exploit indicators
EPSS
0.000 · p0
Known exploited (KEV)
No
Known exploits — Сканер-ВС
CVE-2024-37051
github-poc · https://github.com/mrblackstar26/CVE-2024-37051
Affected software
| Product | Vendor | Status |
|---|---|---|
| aqua | jetbrains | Tracked |
| clion | jetbrains | Tracked |
| clion | jetbrains | Tracked |
| clion | jetbrains | Tracked |
| clion | jetbrains | Tracked |
| datagrip | jetbrains | Tracked |
| datagrip | jetbrains | Tracked |
| datagrip | jetbrains | Tracked |
| datagrip | jetbrains | Tracked |
| dataspell | jetbrains | Tracked |
| dataspell | jetbrains | Tracked |
| dataspell | jetbrains | Tracked |
| dataspell | jetbrains | Tracked |
| goland | jetbrains | Tracked |
| goland | jetbrains | Tracked |
| goland | jetbrains | Tracked |
| goland | jetbrains | Tracked |
| intellij idea | jetbrains | Tracked |
| intellij idea | jetbrains | Tracked |
| intellij idea | jetbrains | Tracked |
Source databases
BDU
BDU
Data Bank of Information Security Threats
BDU ФСТЭК is the authoritative Russian source of vulnerability information, covering both international CVEs relevant to domestic software and unique Russian-disclosed issues. Entries contain severity, affected product lists (in Russian), and mitigation recommendations.
Region
RU
Updates
1 ч
License
Открытые данные
Russian federal catalog of vulnerabilities and threats maintained by FSTEC. Required for compliance with Russian information security regulations (Приказ №17, Приказ №21).
https://bdu.fstec.ru →Related vulnerabilities