CVE-2019-9872: High severity intellij idea vulnerability
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-9872?
CVE-2019-9872 is a vulnerability in several versions of JetBrains IntelliJ IDEA Ultimate that leads to saving cleartext unencrypted server credentials in IDE configuration files.
How severe is CVE-2019-9872?
CVE-2019-9872 has a severity rating of 8.1 (high).
Which versions of JetBrains IntelliJ IDEA Ultimate are affected by CVE-2019-9872?
JetBrains IntelliJ IDEA Ultimate versions between 2018.1 and 2019.1 are affected by CVE-2019-9872.
How can I fix CVE-2019-9872?
To fix CVE-2019-9872, update your JetBrains IntelliJ IDEA Ultimate to a version above 2019.1.
Where can I find more information about CVE-2019-9872?
You can find more information about CVE-2019-9872 in the JetBrains Security Bulletin for Q1 2019.