CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.jetbrains.com/privacy-security/issues-fixed/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jetbrains:dottrace::::::::
	cpe:2.3:a:jetbrains:dottrace::::::::
	cpe:2.3:a:jetbrains:dottrace::::::::
	cpe:2.3:a:jetbrains:etw_host_service::::::::
	cpe:2.3:a:jetbrains:resharper::::::::
	cpe:2.3:a:jetbrains:resharper::::::::
	cpe:2.3:a:jetbrains:resharper::::::::
	cpe:2.3:a:jetbrains:rider::::::::
	cpe:2.3:a:jetbrains:rider::::::::
	cpe:2.3:a:jetbrains:rider::::::::

History

No history.

Information

Published : 2025-01-28 16:15

Updated : 2026-01-12 18:53

NVD link : CVE-2025-23385

Mitre link : CVE-2025-23385

CVE.ORG link : CVE-2025-23385

JSON object : View

Products Affected

jetbrains

etw_host_service
dottrace
resharper
rider

CWE

CWE-114

Process Control

NVD-CWE-noinfo

{"id": "CVE-2025-23385", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@jetbrains.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-01-28T16:15:41.377", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["Vendor Advisory"], "source": "cve@jetbrains.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@jetbrains.com", "description": [{"lang": "en", "value": "CWE-114"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible"}, {"lang": "es", "value": "En JetBrains ReSharper antes de 2024.3.4, 2024.2.8 y 2024.1.7, Rider antes de 2024.3.4, 2024.2.8 y 2024.1.7, dotTrace antes de 2024.3.4, 2024.2.8 y 2024.1.7, ETW Host Service antes de 16.43, era posible la escalada de privilegios locales a trav\u00e9s del servicio de host ETW."}], "lastModified": "2026-01-12T18:53:54.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:dottrace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA1E83F7-8826-4C16-AC4E-0EA394EBF660", "versionEndExcluding": "2024.1.7"}, {"criteria": "cpe:2.3:a:jetbrains:dottrace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63C92B5D-1EFC-4A0B-950D-D8929640B91E", "versionEndExcluding": "2024.2.8", "versionStartIncluding": "2024.2"}, {"criteria": "cpe:2.3:a:jetbrains:dottrace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DFCF86D-C418-439A-8AD0-4A401148D6B0", "versionEndExcluding": "2024.3.4", "versionStartIncluding": "2024.3"}, {"criteria": "cpe:2.3:a:jetbrains:etw_host_service:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F895DD80-363B-442D-87E3-24994B02DAC3", "versionEndExcluding": "16.43"}, {"criteria": "cpe:2.3:a:jetbrains:resharper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3065499-46FE-48DE-A334-E5ED8A85072E", "versionEndExcluding": "2024.1.7"}, {"criteria": "cpe:2.3:a:jetbrains:resharper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "812D1640-EFD2-4030-B6AE-9AA0923CFB65", "versionEndExcluding": "2024.2.8", "versionStartIncluding": "2024.2"}, {"criteria": "cpe:2.3:a:jetbrains:resharper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9349926-4C6C-4259-835D-09609269CEEA", "versionEndExcluding": "2024.3.4", "versionStartIncluding": "2024.3"}, {"criteria": "cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25FBD05C-2DED-47BB-9AD9-2CB8E4B73ACA", "versionEndExcluding": "2024.1.7"}, {"criteria": "cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9BFA83D-5863-4722-A7B3-27BAC16F1257", "versionEndExcluding": "2024.2.8", "versionStartIncluding": "2024.2.0"}, {"criteria": "cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7A326F4-4B47-4D70-986F-0CF33FBE06B3", "versionEndExcluding": "2024.3.4", "versionStartIncluding": "2024.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@jetbrains.com"}