CVE-2022-46826 - Vulnerability Details - OpenCVE

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Jetbrains	Intellij Idea

Configuration 1 [-]

cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.jetbrains.com/privacy-security/issues-fixed/

History

Wed, 23 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: JetBrains

Published: 2022-12-08T17:37:56.568Z

Updated: 2025-04-23T14:23:02.640Z

Reserved: 2022-12-08T16:48:48.100Z

Link: CVE-2022-46826

Vulnrichment

Updated: 2024-08-03T14:39:38.606Z

NVD

Status : Modified

Published: 2022-12-08T18:15:10.053

Modified: 2024-11-21T07:31:07.537

Link: CVE-2022-46826

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-46826", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "state": "PUBLISHED", "assignerShortName": "JetBrains", "requesterUserId": "c4d2a3a2-8606-4ae0-b01e-0190731f333d", "dateReserved": "2022-12-08T16:48:48.100Z", "datePublished": "2022-12-08T17:37:56.568Z", "dateUpdated": "2025-04-23T14:23:02.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2022-12-08T17:37:56.568Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-35", "cweId": "CWE-35"}]}], "affected": [{"vendor": "JetBrains", "product": "IntelliJ IDEA", "versions": [{"version": "0", "status": "affected", "lessThan": "2022.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability."}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:39:38.606Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:22:54.896320Z", "id": "CVE-2022-46826", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:23:02.640Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:39:38.606Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-46826", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:22:54.896320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:22:58.350Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JetBrains", "product": "IntelliJ IDEA", "versions": [{"status": "affected", "version": "0", "lessThan": "2022.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "descriptions": [{"lang": "en", "value": "In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-35", "description": "CWE-35"}]}], "providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2022-12-08T17:37:56.568Z"}}}, "cveMetadata": {"cveId": "CVE-2022-46826", "state": "PUBLISHED", "dateUpdated": "2025-04-23T14:23:02.640Z", "dateReserved": "2022-12-08T16:48:48.100Z", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "datePublished": "2022-12-08T17:37:56.568Z", "requesterUserId": "c4d2a3a2-8606-4ae0-b01e-0190731f333d", "assignerShortName": "JetBrains"}, "dataVersion": "5.1"}