High severity · published Jan 30, 2020
CVE-2020-7906
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RI
Rider · Jetbrains
2019.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7906
Vendor Advisory
https://blog.jetbrains.com
Vendor Advisory
https://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/
More from Rider
7.8
CVE-2025-23385
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service…
7.8
CVE-2022-37396
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
7.8
CVE-2019-14960
JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file
7.5
CVE-2025-43016
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session
7.5
CVE-2024-37051
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3;…