CVE-2024-37051

high

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202…

Vendor / product: Jetbrains — aqua

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

CVSS

7.5

7.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2024-06-10 16:15

Modified: 2026-11-03 22:17

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-11-03 22:24 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

jetbrains / aqua <2024.1.2

jetbrains / clion <2023.1.7, ≥2023.2.0 <2023.2.4, ≥2023.3.0 <2023.3.5, ≥2024.1.0 <2024.1.3

jetbrains / datagrip ≥2023.1.0 <2023.1.3, ≥2023.2.0 <2023.2.4, ≥2023.3.0 <2023.3.5, ≥2024.1.0 <2024.1.4

jetbrains / dataspell <2023.1.6, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.6, ≥2024.1.0 <2024.1.2

jetbrains / goland <2023.1.6, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.7, ≥2024.1.0 <2024.1.3

jetbrains / intellij_idea <2023.1.7, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.7, ≥2024.1.0 <2024.1.3

jetbrains / mps <2023.2.1, 2023.3.0

jetbrains / phpstorm <2023.1.6, ≥2023.2.0 <2023.2.6, ≥2023.3.0 <2023.3.7, ≥2024.1.0 <2024.1.3

jetbrains / pycharm <2023.1.6, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.6, ≥2024.1.0 <2024.1.3

jetbrains / rider <2023.1.7, ≥2023.2.0 <2023.2.5, ≥2023.3.0 <2023.3.6, ≥2024.1.0 <2024.1.3

jetbrains / rubymine <2023.1.7, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.7, ≥2024.1.0 <2024.1.3

jetbrains / rustrover <2024.1.1

jetbrains / webstorm <2023.1.6, ≥2023.2.0 <2023.2.7, ≥2023.3.0 <2023.3.7, ≥2024.1.0 <2024.1.4

Weakness classification (CWE)

CWE-522

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://www.jetbrains.com/privacy-security/issues-fixed/

References

https://security.netapp.com/advisory/ntap-20240705-0004/ cve@jetbrains.com
https://www.jetbrains.com/privacy-security/issues-fixed/ cve@jetbrains.com
https://security.netapp.com/advisory/ntap-20240705-0004/ af854a3a-2127-422b-91ae-364da2661108
https://www.jetbrains.com/privacy-security/issues-fixed/ af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 22:24 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2024-37051

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs