CVE-2021-45977: 
NixOS vulnerability analysis and mitigation

JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) were found to bind to the 0.0.0.0 IP address. This vulnerability was assigned CVE-2021-45977 and was discovered by Damian Gwiżdż (JetBrains Blog).

The vulnerability involves an unexpected open port on the backend server when using JetBrains IDEs as Remote Development backends. The issue has a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The binding of the IDE to 0.0.0.0 IP address could potentially expose the development environment to unauthorized access from any network interface, which could lead to significant security risks including unauthorized code access and execution (NVD).

The vulnerability has been fixed in the following versions: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1. Users are advised to upgrade to these fixed versions (JetBrains Blog).