CVE-2024-37051

CriticalCVSS 9.3

Published: 10/06/2024(UTC)Updated: 03/11/2026(UTC)Translated: 03/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.88%

92th percentile - higher than 92% of all known CVEs

Summary

A GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and before specific fixed versions (including IntelliJ IDEA, PyCharm, WebStorm, GoLand, PhpStorm, Rider, RubyMine, CLion, DataGrip, DataSpell, Aqua, MPS, RustRover).

Risk Assessment

Token leakage may allow an attacker to access the organization's repositories and resources according to the token's permissions, leading to unauthorized changes or code exposure.

Recommendation

Update affected JetBrains IDEs to fixed versions and revoke/rotate any GitHub tokens that may have been exposed.

Other vulnerabilities in JetBrains IDEs

CVE-2026-118696High
In JetBrains products (IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, DataSpell) before the versions specified in the description, the embedded browser trusted revoked intermediate certificates. This could lead to acceptance of invalid certificates.

Original NVD description (English source)

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Vulnerability data from NVD (NIST) · CISA KEV · EPSS