In the fourth quarter of 2019, we resolved a series of security issues in our products. Here's a summary report that contains a description of each issue and the version in which it was resolved.

ProductDescriptionSeverityResolved inCVE/CWEIDETalk pluginXXE in IDETalk plugin. (IDEA-220136 reported by Srikanth Ramu)Moderate193.4099.10CVE-2019-18412IntelliJ IDEASome Maven repositories are accessed via HTTP instead of HTTPs. (IDEA-216282)High2019.3CVE-2020-7904IntelliJ IDEAPorts listened to by IntelliJ IDEA are exposed to the network. (IDEA-219695)Low2019.3CVE-2020-7905IntelliJ IDEAXSLT debugger plugin misconfiguration allows arbitrary file read over network. (IDEA-216621 reported by Anatoly Korniltsev)Moderate2019.3CVE-2020-7914JetBrains AccountProfile names are exposed by email. (JPF-9219 reported by Timon Birk)Low2019.11CWE-200JetBrains AccountMissing secure flag for cookie. (JPF-9857)Low2019.11CWE-614JetBrains AccountInsufficient authentication on contact view. (JPF-10024)High2019.11CWE-287JetBrains AccountInsufficient authentication on role update. (JPF-10025)High2019.11CWE-287JetBrains AccountXSS on the spending report page. (JPF-10027)Moderate2019.12CWE-79JetBrains AccountOpen redirect during re-acceptance of license agreements. (JPF-10028)Low2019.11CWE-601JetBrains AccountInformation exposure during processing of license requests. (JPF-10111)High2019.12CWE-200JetBrains WebsiteCookie XSS at jetbrains.com. (JS-10969)HighNot applicableCWE-79Kotlin KtorThe Ktor framework is vulnerable to HTTP Response Splitting. Reported by Jonathan LeitschuhHigh1.2.6CVE-2019-19389Kotlin KtorThe Ktor client resends authorization data to a redirect location. Reported by Jonathan LeitschuLow1.2.6CVE-2019-19703Kotlin KtorRequest smuggling is possible when both chunked Transfer-Encoding and Content-Length are specified. Reported by Jonathan LeitschuhLow1.3.0CVE-2020-5207Plugin MarketplaceXSS on several pages. (MP-2617, MP-2640, MP-2642)LowNot applicableCWE-79Plugin MarketplaceImproper access control during plugins upload. (MP-2695)CriticalNot applicableCWE-284RiderUnsigned binaries in Windows installer. (RIDER-30393)Moderate2019.3CVE-2020-7906Scala pluginArtifact dependencies were resolved over unencrypted connections. (SCL-15063)High2019.2.1CVE-2020-7907TeamCityReverse Tabnabbing is possible on several pages. (TW-61710, TW-61726, TW-61727)Low2019.1.5CVE-2020-7908TeamCitySome server-stored passwords can be shown via web UI. (TW-62674)High2019.1.5CVE-2020-7909TeamCityPossible stored XSS attack by a user with a developer role. (TW-63298)Moderate2019.2CVE-2020-7910TeamCityStored XSS on user-level pages. (TW-63160)High2019.2CVE-2020-7911YouTrackCORS misconfiguration on youtrack.jetbrains.com. (JT-53675)ModerateNot applicableCWE-346YouTrackSMTP/Jabber settings can be accessed using backups. (JT-54139)Moderate2019.2.59309CVE-2020-7912YouTrackXSS via image upload at youtrack-workflow-converter.jetbrains.com. (JT-54589)LowNot applicableCWE-80YouTrackXSS via issue description. (JT-54719)High2019.2.59309CVE-2020-7913

If you need any further assistance, please contact our Security Team.

Subscribe to receive the bulletin in your mailbox.

Your JetBrains Team The Drive to Develop