← Vulnerability feed

Vulnerability record · CVE-2019-9186 · published 3 July 2019

CVE-2019-9186: Jetbrains intellij idea exposure of resource to wrong sphere vulnerability

Jetbrains · Intellij Idea

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

9.8 CVSS 3.0 Critical EPSS 4.5% · top 8.8% CWE-668 · Exposure of resource to wrong sphere
9.8CVSS 3.0 base score, v2 7.5
4.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ Vendor Advisory
https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ Vendor Advisory

Track CVE-2019-9186 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-64812Jetbrains intellij idea missing authentication for critical function vulnerabilityIn JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development sessionEPSS 0.48%10.0CVE-2026-64813Jetbrains intellij idea vulnerabilityIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionEPSS 0.52%9.8CVE-2026-64815Jetbrains intellij idea code injection vulnerabilityIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form filesEPSS 0.48%9.8CVE-2026-59792Jetbrains intellij idea relative path traversal vulnerabilityIn JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possibleEPSS 0.61%9.8CVE-2023-51655Jetbrains intellij idea insufficient verification of data authenticity vulnerabilityIn JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the p…EPSS 0.33%9.8CVE-2021-45977Jetbrains clion vulnerabilityJetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, Ph…EPSS 1.1%9.8CVE-2020-11690Jetbrains intellij idea vulnerabilityIn JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.EPSS 2.3%9.8CVE-2019-9823Jetbrains intellij idea cleartext storage of sensitive data vulnerabilityIn several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of t…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2019-9186), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.