Vulnerability-Lookup

CVE-2019-9186 (GCVE-0-2019-9186)

Vulnerability from cvelistv5 – Published: 2019-07-03 18:35 – Updated: 2024-08-04 21:38

Summary

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://blog.jetbrains.com/blog/2019/06/19/jetbra…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T21:38:46.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-03T18:35:06.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-9186",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/",
              "refsource": "CONFIRM",
              "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-9186",
    "datePublished": "2019-07-03T18:35:06.000Z",
    "dateReserved": "2019-02-26T00:00:00.000Z",
    "dateUpdated": "2024-08-04T21:38:46.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-9186",
      "date": "2026-07-25",
      "epss": "0.04509",
      "percentile": "0.90517"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2018.1\", \"versionEndExcluding\": \"2018.1.8\", \"matchCriteriaId\": \"F6F6ABD2-387F-49D7-8C20-2E2D4D4F1313\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2018.2\", \"versionEndExcluding\": \"2018.2.8\", \"matchCriteriaId\": \"A4A62C32-1751-42AC-85B9-43BE8E358930\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2018.3\", \"versionEndExcluding\": \"2018.3.5\", \"matchCriteriaId\": \"5CD2EE41-43C6-4328-A767-7271D1BE7D1F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2018.3.6\", \"versionEndExcluding\": \"2019.1\", \"matchCriteriaId\": \"DA42965B-0D50-45AC-B28E-39016D2023CC\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.\"}, {\"lang\": \"es\", \"value\": \"En varias versiones de JetBrains IntelliJ IDEA, una configuraci\\u00f3n de ejecuci\\u00f3n Spring Boot con la configuraci\\u00f3n predeterminada permiti\\u00f3 a los atacantes remotos ejecutar c\\u00f3digo cuando la configuraci\\u00f3n se est\\u00e1 ejecutando, porque un servidor JMX escucha en todas las interfaces (en lugar de escuchar solo en la interfaz localhost). Este problema se ha solucionado en las siguientes versiones: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8 y 2017.3.7.\"}]",
      "id": "CVE-2019-9186",
      "lastModified": "2024-11-21T04:51:09.973",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-07-03T19:15:13.567",
      "references": "[{\"url\": \"https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-668\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-9186\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-07-03T19:15:13.567\",\"lastModified\":\"2024-11-21T04:51:09.973\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.\"},{\"lang\":\"es\",\"value\":\"En varias versiones de JetBrains IntelliJ IDEA, una configuraci\u00f3n de ejecuci\u00f3n Spring Boot con la configuraci\u00f3n predeterminada permiti\u00f3 a los atacantes remotos ejecutar c\u00f3digo cuando la configuraci\u00f3n se est\u00e1 ejecutando, porque un servidor JMX escucha en todas las interfaces (en lugar de escuchar solo en la interfaz localhost). Este problema se ha solucionado en las siguientes versiones: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8 y 2017.3.7.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2018.1\",\"versionEndExcluding\":\"2018.1.8\",\"matchCriteriaId\":\"F6F6ABD2-387F-49D7-8C20-2E2D4D4F1313\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2018.2\",\"versionEndExcluding\":\"2018.2.8\",\"matchCriteriaId\":\"A4A62C32-1751-42AC-85B9-43BE8E358930\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2018.3\",\"versionEndExcluding\":\"2018.3.5\",\"matchCriteriaId\":\"5CD2EE41-43C6-4328-A767-7271D1BE7D1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2018.3.6\",\"versionEndExcluding\":\"2019.1\",\"matchCriteriaId\":\"DA42965B-0D50-45AC-B28E-39016D2023CC\"}]}]}],\"references\":[{\"url\":\"https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

CNVD-2019-21935

Vulnerability from cnvd - Published: 2019-07-10

Title

JetBrains IntelliJ IDEA代码执行漏洞

Description

JetBrains IntelliJ IDEA是捷克JetBrains公司的一套适用于Java语言的集成开发环境。 JetBrains IntelliJ IDEA中存在安全漏洞。远程攻击者可利用该漏洞执行代码。

Severity

高

Patch Name

JetBrains IntelliJ IDEA代码执行漏洞的补丁

Patch Description

JetBrains IntelliJ IDEA是捷克JetBrains公司的一套适用于Java语言的集成开发环境。 JetBrains IntelliJ IDEA中存在安全漏洞。远程攻击者可利用该漏洞执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-9186

Impacted products

Name
JetBrains JetBrains IntelliJ IDEA

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-9186",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-9186"
    }
  },
  "description": "JetBrains IntelliJ IDEA\u662f\u6377\u514bJetBrains\u516c\u53f8\u7684\u4e00\u5957\u9002\u7528\u4e8eJava\u8bed\u8a00\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u3002\n\nJetBrains IntelliJ IDEA\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4ee3\u7801\u3002",
  "discovererName": "unKnow",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-21935",
  "openTime": "2019-07-10",
  "patchDescription": "JetBrains IntelliJ IDEA\u662f\u6377\u514bJetBrains\u516c\u53f8\u7684\u4e00\u5957\u9002\u7528\u4e8eJava\u8bed\u8a00\u7684\u96c6\u6210\u5f00\u53d1\u73af\u5883\u3002\r\n\r\nJetBrains IntelliJ IDEA\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "JetBrains IntelliJ IDEA\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "JetBrains JetBrains IntelliJ IDEA"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-9186",
  "serverity": "\u9ad8",
  "submitTime": "2019-07-10",
  "title": "JetBrains IntelliJ IDEA\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

FKIE_CVE-2019-9186

Vulnerability from fkie_nvd - Published: 2019-07-03 19:15 - Updated: 2026-06-17 02:43

Severity

9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@mitre.org	https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/	Vendor Advisory

Impacted products

Vendor	Product	Version
jetbrains	intellij_idea	*
jetbrains	intellij_idea	*
jetbrains	intellij_idea	*
jetbrains	intellij_idea	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6F6ABD2-387F-49D7-8C20-2E2D4D4F1313",
              "versionEndExcluding": "2018.1.8",
              "versionStartIncluding": "2018.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4A62C32-1751-42AC-85B9-43BE8E358930",
              "versionEndExcluding": "2018.2.8",
              "versionStartIncluding": "2018.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CD2EE41-43C6-4328-A767-7271D1BE7D1F",
              "versionEndExcluding": "2018.3.5",
              "versionStartIncluding": "2018.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA42965B-0D50-45AC-B28E-39016D2023CC",
              "versionEndExcluding": "2019.1",
              "versionStartIncluding": "2018.3.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7."
    },
    {
      "lang": "es",
      "value": "En varias versiones de JetBrains IntelliJ IDEA, una configuraci\u00f3n de ejecuci\u00f3n Spring Boot con la configuraci\u00f3n predeterminada permiti\u00f3 a los atacantes remotos ejecutar c\u00f3digo cuando la configuraci\u00f3n se est\u00e1 ejecutando, porque un servidor JMX escucha en todas las interfaces (en lugar de escuchar solo en la interfaz localhost). Este problema se ha solucionado en las siguientes versiones: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8 y 2017.3.7."
    }
  ],
  "id": "CVE-2019-9186",
  "lastModified": "2026-06-17T02:43:19.187",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-03T19:15:13.567",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-3Q85-VGCX-WV5M

Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2022-05-24 16:49

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-9186"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-03T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.",
  "id": "GHSA-3q85-vgcx-wv5m",
  "modified": "2022-05-24T16:49:26Z",
  "published": "2022-05-24T16:49:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9186"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2019-9186

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-9186

Aliases

CVE-2019-9186

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-9186",
    "description": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.",
    "id": "GSD-2019-9186"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-9186"
      ],
      "details": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.",
      "id": "GSD-2019-9186",
      "modified": "2023-12-13T01:23:47.427877Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-9186",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/",
            "refsource": "CONFIRM",
            "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2018.2.8",
                "versionStartIncluding": "2018.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2018.3.5",
                "versionStartIncluding": "2018.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1",
                "versionStartIncluding": "2018.3.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2018.1.8",
                "versionStartIncluding": "2018.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-9186"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-668"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-07-21T11:39Z",
      "publishedDate": "2019-07-03T19:15Z"
    }
  }
}

ubuntu-cve-2019-9186

Vulnerability from osv_ubuntu

Published

2019-07-03 19:15

Modified

2026-05-20 14:51

Summary

Details

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2019-9186	REPORT
	https://www.cve.org/CVERecord?id=CVE-2019-9186	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libintellij-core-java",
            "binary_version": "183.5153.4-2"
          },
          {
            "binary_name": "libintellij-extensions-java",
            "binary_version": "183.5153.4-2"
          },
          {
            "binary_name": "libintellij-jps-model-java",
            "binary_version": "183.5153.4-2"
          },
          {
            "binary_name": "libintellij-platform-api-java",
            "binary_version": "183.5153.4-2"
          },
          {
            "binary_name": "libintellij-platform-impl-java",
            "binary_version": "183.5153.4-2"
          },
          {
            "binary_name": "libintellij-utils-java",
            "binary_version": "183.5153.4-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "intellij-community-idea",
        "purl": "pkg:deb/ubuntu/intellij-community-idea@183.5153.4-2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "183.5153.4-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libintellij-core-java",
            "binary_version": "183.5153.4-4ubuntu1"
          },
          {
            "binary_name": "libintellij-extensions-java",
            "binary_version": "183.5153.4-4ubuntu1"
          },
          {
            "binary_name": "libintellij-jps-model-java",
            "binary_version": "183.5153.4-4ubuntu1"
          },
          {
            "binary_name": "libintellij-platform-api-java",
            "binary_version": "183.5153.4-4ubuntu1"
          },
          {
            "binary_name": "libintellij-platform-impl-java",
            "binary_version": "183.5153.4-4ubuntu1"
          },
          {
            "binary_name": "libintellij-utils-java",
            "binary_version": "183.5153.4-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "intellij-community-idea",
        "purl": "pkg:deb/ubuntu/intellij-community-idea@183.5153.4-4ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "183.5153.4-3",
        "183.5153.4-4",
        "183.5153.4-4ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libintellij-core-java",
            "binary_version": "183.5153.4-6"
          },
          {
            "binary_name": "libintellij-extensions-java",
            "binary_version": "183.5153.4-6"
          },
          {
            "binary_name": "libintellij-jps-model-java",
            "binary_version": "183.5153.4-6"
          },
          {
            "binary_name": "libintellij-platform-api-java",
            "binary_version": "183.5153.4-6"
          },
          {
            "binary_name": "libintellij-platform-impl-java",
            "binary_version": "183.5153.4-6"
          },
          {
            "binary_name": "libintellij-utils-java",
            "binary_version": "183.5153.4-6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "intellij-community-idea",
        "purl": "pkg:deb/ubuntu/intellij-community-idea@183.5153.4-6?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "183.5153.4-5",
        "183.5153.4-6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libintellij-core-java",
            "binary_version": "183.5153.4-7"
          },
          {
            "binary_name": "libintellij-extensions-java",
            "binary_version": "183.5153.4-7"
          },
          {
            "binary_name": "libintellij-jps-model-java",
            "binary_version": "183.5153.4-7"
          },
          {
            "binary_name": "libintellij-platform-api-java",
            "binary_version": "183.5153.4-7"
          },
          {
            "binary_name": "libintellij-platform-impl-java",
            "binary_version": "183.5153.4-7"
          },
          {
            "binary_name": "libintellij-utils-java",
            "binary_version": "183.5153.4-7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "intellij-community-idea",
        "purl": "pkg:deb/ubuntu/intellij-community-idea@183.5153.4-7?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "183.5153.4-6",
        "183.5153.4-6ubuntu1",
        "183.5153.4-7"
      ]
    }
  ],
  "aliases": [],
  "details": "In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.",
  "id": "UBUNTU-CVE-2019-9186",
  "modified": "2026-05-20T14:51:13Z",
  "published": "2019-07-03T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-9186"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-9186"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2019-9186"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2019-9186 (GCVE-0-2019-9186)

CNVD-2019-21935

FKIE_CVE-2019-9186

GHSA-3Q85-VGCX-WV5M

GSD-2019-9186

ubuntu-cve-2019-9186

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature