CVE-2020-11690 Server-side request forgery in n/a
Attackers can redirect license server requests to untrusted hosts, potentially exposing data or bypassing security checks in IntelliJ IDEA.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11690?
CVE-2020-11690 is a critical server-side request forgery vulnerability in Jetbrains Intellij Idea, published on 22 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.
Which versions are affected by CVE-2020-11690?
It affects 1 product.
Products include Jetbrains Intellij Idea.
How do I fix CVE-2020-11690?
No fix has been published for CVE-2020-11690 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-11690 being exploited?
There is no known exploitation of CVE-2020-11690 in the wild and no public exploit code.
Other vulnerabilities in Jetbrains Intellij Idea
Sources
Also known as GHSA-5m6g-mcf5-6jx2, UBUNTU-CVE-2020-11690.