SB2020020410 - Multiple vulnerabilities in JetBrains Account

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020020410

SB2020020410 - Multiple vulnerabilities in JetBrains Account

Published: February 4, 2020

Security Bulletin ID SB2020020410
Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Profile names are exposed by email. A remote attacker can gain unauthorized access to sensitive information on the system.


2) Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to the affected software does not set the secure attribute on authorization tokens or session cookies. A remote attacker can intercept the transmission and obtain information from the cookie in clear text.


3) Improper Authentication (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in contact view. A remote attacker can bypass authentication process and gain unauthorized access to the application.


4) Improper Authentication (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error on role update. A remote attacker can bypass authentication process and gain unauthorized access to the application.


5) Open redirect (CVE-ID: N/A)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data during re-acceptance of license agreements. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.


Remediation

Install update from vendor's website.

References