CVE-2019-9872 - CVE House
Back to Database
Status published High CVE-2019-9872

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run...

Vulnerability Description

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9872

Credits & Attribution

No credits recorded in the NVD database.

References

More from jetbrains

View All →
CVE-2022-25264
In JetBrains TeamCity before 2021.2.3, environment variables of the "password"...
High 7.5
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection...
Critical 9.8
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible....
Critical 9.8
CVE-2022-25261
JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS....
Medium 6.1
CVE-2022-25260
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request...
Critical 9.1

Affected Vendor

Affected Software

intellij idea
Vulnerable Versions:
2018.1, 2018.2, 2018.3, 2018.3.6

Timeline

Official Publish: July 3rd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.