CVE-2024-37051

JetBrains Clion vulnerability

9.3 CRITICALEPSS 4.88%

Published10 Jun 2024

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

JetBrains Aqua< 2024.1.2

JetBrains Clion≥ 2023.2.0 < 2023.2.4 · ≥ 2023.3.0 < 2023.3.5 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.7

JetBrains Datagrip≥ 2023.1.0 < 2023.1.3 · ≥ 2023.2.0 < 2023.2.4 · ≥ 2023.3.0 < 2023.3.5 · ≥ 2024.1.0 < 2024.1.4

JetBrains Dataspell≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.6 · ≥ 2024.1.0 < 2024.1.2 · < 2023.1.6

JetBrains Goland≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.7 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.6

JetBrains Intellij Idea≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.7 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.7

JetBrains Mps< 2023.2.1 · 2023.3.0

JetBrains Phpstorm≥ 2023.2.0 < 2023.2.6 · ≥ 2023.3.0 < 2023.3.7 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.6

JetBrains Pycharm≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.6 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.6

JetBrains Rider≥ 2023.2.0 < 2023.2.5 · ≥ 2023.3.0 < 2023.3.6 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.7

JetBrains Rubymine≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.7 · ≥ 2024.1.0 < 2024.1.3 · < 2023.1.7

JetBrains Rustrover< 2024.1.1

JetBrains Webstorm≥ 2023.2.0 < 2023.2.7 · ≥ 2023.3.0 < 2023.3.7 · ≥ 2024.1.0 < 2024.1.4 · < 2023.1.6

Remediation

Fixed in

JetBrains Aqua≥ 2024.1.2

JetBrains Clion≥ 2023.2.4

JetBrains Datagrip≥ 2023.1.3

JetBrains Dataspell≥ 2023.2.7

JetBrains Goland≥ 2023.2.7

JetBrains Intellij Idea≥ 2023.2.7

JetBrains Mps≥ 2023.2.1

JetBrains Phpstorm≥ 2023.2.6

JetBrains Pycharm≥ 2023.2.7

JetBrains Rider≥ 2023.2.5

Frequently asked

Is CVE-2024-37051 being actively exploited?

CVE-2024-37051 is not in the CISA KEV catalog. Its EPSS exploit probability is 4.88%.

How severe is CVE-2024-37051?

CVE-2024-37051 has a CVSS 3.1 base score of 9.3, rated critical. EPSS estimates a 4.88% probability of exploitation.

Which products are affected by CVE-2024-37051?

Affected products include JetBrains Aqua, JetBrains Clion, JetBrains Datagrip, JetBrains Dataspell, JetBrains Goland, and 8 more.

How do I fix CVE-2024-37051?

Upgrade affected software to a fixed version, for example JetBrains Aqua 2024.1.2, JetBrains Clion 2023.2.4, JetBrains Datagrip 2023.1.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-37051 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.