HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2025-23385

CVSS 7.8v3.1pub. 2025-01-28upd. 2026-01-12

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Jetbrains Dottrace

    APP
    Jetbrains
    < 2024.1.72024.2 – 2024.2.8 (excl.)2024.3 – 2024.3.4 (excl.)

  • Jetbrains Etw Host Service

    APP
    Jetbrains
    < 16.43

  • Jetbrains Resharper

    APP
    Jetbrains
    < 2024.1.72024.2 – 2024.2.8 (excl.)2024.3 – 2024.3.4 (excl.)

  • Jetbrains Rider

    APP
    Jetbrains
    < 2024.1.72024.2.0 – 2024.2.8 (excl.)2024.3.0 – 2024.3.4 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2024-37051CRITICAL9.3PL ✓same product

Wyciek tokenu GitHub do stron trzecich w JetBrains IDE

CVE-2025-64456HIGH8.4same product

In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege ...

CVE-2020-7906HIGH7.5same product

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Wind...

CVE-2019-16407HIGH7.3same product

JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability.

CVE-2019-14960HIGH7.8same product

JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.