CVE-2024-37051

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-10 · updated 2026-06-17
Weakness: CWE-522

Description

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Affected products

JetBrains Aqua: before 2024.1.2 — fixed in 2024.1.2
JetBrains CLion: before 2023.1.7; from 2023.2.0 before 2023.2.4; from 2023.3.0 before 2023.3.5; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3
JetBrains DataGrip: from 2023.1.0 before 2023.1.3; from 2023.2.0 before 2023.2.4; from 2023.3.0 before 2023.3.5; from 2024.1.0 before 2024.1.4 — fixed in 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4
JetBrains DataSpell: before 2023.1.6; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.6; from 2024.1.0 before 2024.1.2 — fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2
JetBrains GoLand: before 2023.1.6; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.7; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3
JetBrains IntelliJ IDEA: before 2023.1.7; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.7; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3
JetBrains MPS: before 2023.2.1; 2023.3.0 — fixed in 2023.2.1
JetBrains PhpStorm: before 2023.1.6; from 2023.2.0 before 2023.2.6; from 2023.3.0 before 2023.3.7; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3
JetBrains PyCharm: before 2023.1.6; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.6; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3
JetBrains Rider: before 2023.1.7; from 2023.2.0 before 2023.2.5; from 2023.3.0 before 2023.3.6; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3
JetBrains RubyMine: before 2023.1.7; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.7; from 2024.1.0 before 2024.1.3 — fixed in 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3
JetBrains RustRover: before 2024.1.1 — fixed in 2024.1.1
JetBrains WebStorm: before 2023.1.6; from 2023.2.0 before 2023.2.7; from 2023.3.0 before 2023.3.7; from 2024.1.0 before 2024.1.4 — fixed in 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

How to fix

Upgrade to a fixed version: JetBrains Aqua 2024.1.2; JetBrains CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3; JetBrains DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; JetBrains DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2; JetBrains GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3; JetBrains IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3; JetBrains MPS 2023.2.1; JetBrains PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3; JetBrains PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3; JetBrains Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; JetBrains RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3; JetBrains RustRover 2024.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-37051 or the next vulnerability affects your stack