PT-2025-31117 · Jetbrains · Jetbrains Youtrack

Published 2025-07-28 · Updated 2025-12-01 · CVE-2025-54527

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.2.86935 JetBrains YouTrack version 2025.2.86935 JetBrains YouTrack versions 2025.2.86935 through 2025.2.87167 JetBrains YouTrack version 2025.3.87341 JetBrains YouTrack versions 2025.3.87341 through 2025.3.87344

Description The software contains an improper iframe configuration within the widget sandbox, which allows popups to bypass security restrictions.

Recommendations Update JetBrains YouTrack to a version later than 2025.2.86935. Update JetBrains YouTrack to version 2025.2.86935. Update JetBrains YouTrack to a version later than 2025.2.87167. Update JetBrains YouTrack to a version later than 2025.3.87341. Update JetBrains YouTrack to a version later than 2025.3.87344.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2025-09157

CVE-2025-54527

Affected Products

Jetbrains Youtrack

References · 9

• https://osv.dev/vulnerability/CVE-2025-54527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54527 · Security Note
• https://bdu.fstec.ru/vul/2025-09157 · Security Note
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://t.me/CVEtracker/28588 · Telegram Post
• https://twitter.com/dailycve/status/1995613625747488900 · Twitter Post
• https://twitter.com/CVEnew/status/1949876367836827968 · Twitter Post
• https://t.me/cveNotify/144457 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1949921322697445417 · Twitter Post