CVE-2019-10104 - CVE House
Back to Database
Status published Critical CVE-2019-10104

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server...

Vulnerability Description

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10104

Credits & Attribution

No credits recorded in the NVD database.

References

More from jetbrains

View All →
CVE-2022-25264
In JetBrains TeamCity before 2021.2.3, environment variables of the "password"...
High 7.5
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection...
Critical 9.8
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible....
Critical 9.8
CVE-2022-25261
JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS....
Medium 6.1
CVE-2022-25260
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request...
Critical 9.1

Affected Vendor

Affected Software

intellij idea
Vulnerable Versions:
2018.1, 2018.2, 2018.3, 2018.3.5

Timeline

Official Publish: July 3rd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.