PT-2024-2099 · Jetbrains · Jetbrains Youtrack

Published 2024-03-06 · Updated 2024-12-16 · CVE-2024-28228

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2024.1.25893

Description The issue is related to authentication bypass via spoofing, allowing a remote attacker to create comments on behalf of an arbitrary user. This can be exploited in the HelpDesk component of JetBrains YouTrack.

Recommendations For versions prior to 2024.1.25893, update to version 2024.1.25893 or later to resolve the issue. As a temporary workaround, consider restricting access to the HelpDesk component to minimize the risk of exploitation.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2024-01995

CVE-2024-28228

Affected Products

Jetbrains Youtrack

References · 8

• https://osv.dev/vulnerability/CVE-2024-28228 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28228 · Security Note
• https://bdu.fstec.ru/vul/2024-01995 · Security Note
• https://twitter.com/VulmonFeeds/status/1765732335989776505 · Twitter Post
• https://t.me/cvenotify/73242 · Telegram Post
• https://t.me/cvenotify/104376 · Telegram Post
• https://cvedetails.com/cve/CVE-2024-28228 · Note