PT-2024-9180 · Jetbrains · Youtrack

Published 2024-11-29 · Updated 2025-01-31 · CVE-2024-54153

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.51866

Description: The issue is related to the absence of an authorization procedure when handling a query parameter, allowing an unauthenticated database backup download. This could enable a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 2024.3.51866, update to version 2024.3.51866 or later to resolve the issue. As a temporary workaround, consider restricting access to the query parameter to minimize the risk of exploitation. Avoid using the vulnerable query parameter in the affected API endpoint until the issue is resolved.

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

BDU:2024-10867

CVE-2024-54153

Affected Products

Youtrack

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-54153 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54153 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10867 · Security Note
• https://t.me/cvenotify/109431 · Telegram Post
• https://twitter.com/CVEnew/status/1864270361052741828 · Twitter Post
• https://vuldb.com/?id.286865 · Note
• https://t.me/cvedetector/11984 · Telegram Post