Products
JetBrains YouTrack
- before 2024.2.34646
Source
cve@jetbrains.com
Tags
CVE-2024-38504 details
Published : June 18, 2024, 11:15 a.m.
Last Modified : June 18, 2024, 11:15 a.m.
Last Modified : June 18, 2024, 11:15 a.m.
Description
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
CVSS Score
| 1 | 2 | 3 | 4.3 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-862 | Missing Authorization | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Base Score
4.3
Exploitability Score
2.8
Impact Score
1.4
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
| URL | Source |
|---|---|
| https://www.jetbrains.com/privacy-security/issues-fixed/ | cve@jetbrains.com |
This website uses the NVD API, but is not approved or certified by it.