Vulnerabilities

TI-2024-25742 CVE-2024-38506 · GHSA-f989-r6c7-44p6

Missing authorization in JetBrains YouTrack

LOW 35

In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00314 Published 2024-06-18 Fixed in 2024.2.34646 CWE-862

TI-2024-25741 CVE-2024-38505 · GHSA-h8w4-4g94-23mh

LOW 39

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00443 Published 2024-06-18 Fixed in 2024.2.34646 CWE-522

TI-2024-25740 CVE-2024-38504 · GHSA-mf2w-j66c-qcm9

LOW 24

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00362 Published 2024-06-18 Fixed in 2024.2.34646 CWE-862