Vulnerability · Published Jun 18, 2024 · Assigned by Google

CVE-2024-5899Improper trust check in Bazel Build intellij plugin

Low 1.0

In plain English

A low-severity missing authorization in intellij plugin from BazelBuild. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)1.0Low

Exploit odds (30 days)0.1%top 98.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/bazelbuild/intellij	no fix listed	GO-2024-2933

Affected products (as reported)

Vendor	Product	Versions
BazelBuild	intellij plugin	0 – before 2024.06.04.0.2

Weakness: CWE-862 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References