Skip to main content

Intellij Idea CVE-2022-29816

LOW
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2022-04-28 cve@jetbrains.com
Code Injection Intellij Idea
3.2
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.2 LOW
AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 28, 2022 - 10:15 nvd
LOW 3.2

DescriptionNVD

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible

AnalysisAI

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-74. In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible Affected products include: Jetbrains Intellij Idea. Version information: before 2022.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Intellij Idea

View all
CVE-2026-59792 CRITICAL
9.8 Jul 10

Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper

CVE-2023-51655 CRITICAL
9.8 Dec 21

In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin

CVE-2020-11690 CRITICAL
9.8 Apr 22

In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
CVE-2019-9873 CRITICAL
9.8 Jul 03

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
CVE-2019-9823 CRITICAL
9.8 Jul 03

In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
CVE-2019-9186 CRITICAL
9.8 Jul 03

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
CVE-2019-10104 CRITICAL
9.8 Jul 03

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
CVE-2019-9872 HIGH
8.1 Jul 03

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads
CVE-2026-49367 HIGH
8.0 May 29

Command execution in JetBrains IntelliJ IDEA versions prior to 2026.1.1 allows attackers leveraging the guest user accou
CVE-2026-49366 HIGH
7.8 May 29

Command injection in JetBrains IntelliJ IDEA before 2026.1.1 allows attackers to execute arbitrary OS commands by abusin
CVE-2023-39261 HIGH
7.8 Jul 26

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions. Rated high severity (CVS
CVE-2022-47896 HIGH
7.8 Dec 22

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. Rated high severity (CVSS 7.8

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0
CVE-2020-8468 HIGH POC
8.8
CVE-2015-3253 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2022-29816 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy