CVE-2019-9873 : Security Advisory and Response

In various editions of JetBrains IntelliJ IDEA Ultimate, the act of constructing Task Servers configurations results in the storage of server credentials as a clear and unencrypted record in the configuration files of the IDE. This problem has been resolved in the subsequent versions of the software: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.

Understanding CVE-2019-9873

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in versions 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.

What is CVE-2019-9873?

Vulnerability in JetBrains IntelliJ IDEA Ultimate that stores server credentials in clear and unencrypted form in configuration files.

The Impact of CVE-2019-9873

Unauthorized access to sensitive server credentials stored in plaintext.

Technical Details of CVE-2019-9873

In-depth technical information about the vulnerability.

Vulnerability Description

Task Servers configurations in JetBrains IntelliJ IDEA Ultimate store server credentials in clear text in configuration files.

Affected Systems and Versions

Versions affected: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.

Exploitation Mechanism

Attackers can exploit this vulnerability to access and misuse server credentials stored in plaintext.

Mitigation and Prevention

Steps to address and prevent CVE-2019-9873.

Immediate Steps to Take

Update JetBrains IntelliJ IDEA Ultimate to versions 2019.1, 2018.3.5, 2018.2.8, or 2018.1.8 to mitigate the vulnerability.

Long-Term Security Practices

Avoid storing sensitive information in plaintext within configuration files.

Patching and Updates

Regularly update software to the latest versions to ensure security patches are applied.