CVE-2019-10104: Critical severity intellij idea vulnerability
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10104?
CVE-2019-10104 is a vulnerability in several versions of JetBrains IntelliJ IDEA Ultimate that allows a remote attacker to execute code on the target server.
How severe is CVE-2019-10104?
CVE-2019-10104 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2019-10104?
JetBrains IntelliJ IDEA versions 2018.1 to 2018.3.7 are affected by CVE-2019-10104.
How does CVE-2019-10104 work?
CVE-2019-10104 allows a remote attacker to execute code by exploiting a misconfigured JMX server in the Application Server run configuration.
How can I fix CVE-2019-10104?
To fix CVE-2019-10104, upgrade your JetBrains IntelliJ IDEA Ultimate to a version that is not affected by the vulnerability.