CVE-2020-7904

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Jan 30, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-79057.5Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.CVE-2020-79067.5In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was CVE-2020-79077.5In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.CVE-2020-79084.3In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.CVE-2020-79097.5In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.CVE-2020-79105.4JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.CVE-2020-79116.1In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.CVE-2020-79125.3In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.CVE-2020-79136.1JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.CVE-2020-79147.5In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issCVE-2020-79154.8An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.CVE-2020-79166.5be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself
CVE-2020-7904: High severity, CVSS 7.4 | Vulnix