CVE-2024-5899

LOW

Bazel for IntelliJ CLion and Android Studio < 2024.06.04.0.2 - Missing Authorization for Project Import

Title source: llm

Description

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins.

References (2)

Core 2

Core References

Release Notes

https://github.com/bazelbuild/intellij/releases/tag/v2024.06.04-aswb-stable

Vendor Advisory

https://github.com/bazelbuild/intellij/security/advisories/GHSA-hh9f-wmhw-46vg

Scores

CVSS v3 3.3

EPSS 0.0007

EPSS Percentile 21.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (3)

google/bazel_for_android_studio < 2024.06.04.0.2

google/bazel_for_clion < 2024.06.04.0.2

google/bazel_for_intellij < 2024.06.04.0.2

Published Jun 18, 2024

Tracked Since Feb 18, 2026