Low severity · published Feb 3, 2021
CVE-2021-25755
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic
2.5
CVSS
0.4%
EPSS
No
On KEV
Description
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Code With ME · Jetbrains
before 2020.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25755
Product
https://blog.jetbrains.com
Vendor Advisory
https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
Exploit
https://jay-from-future.github.io/cve/2021/04/02/code-with-me-cve.html
More from Code With ME
8.8
CVE-2021-31899
In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode
5.3
CVE-2021-31900
In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host