Vulnerabilities

TI-2024-36270 CVE-2024-54155 · GHSA-m2pc-wfjr-69c4

Missing authorization in JetBrains YouTrack

LOW 24

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00421 Published 2024-12-04 Fixed in 2024.3.51866 CWE-862

TI-2024-36269 CVE-2024-54154 · GHSA-3j57-8hvg-f4cv

MEDIUM 44

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00742 Published 2024-12-04 Fixed in 2024.3.51866 CWE-23

TI-2024-36268 CVE-2024-54153 · GHSA-c453-36cx-pv4g

LOW 29

In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00362 Published 2024-12-04 Fixed in 2024.3.51866 CWE-862