CVE-2025-24458
Published: 21 January 2025
Description
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Security Summary
CVE-2025-24458 affects JetBrains YouTrack in versions before 2024.3.55417, where account takeover is possible via spoofed email and Helpdesk integration. Published on 2025-01-21, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and maps to CWE-290.
The attack requires local access (AV:L) with low complexity (AC:L), no privileges (PR:N), and user interaction (UI:R). An unauthenticated attacker can spoof an email through the Helpdesk integration to achieve account takeover, resulting in high impacts to confidentiality and integrity but no availability disruption.
JetBrains has fixed the issue in YouTrack 2024.3.55417. For mitigation details, refer to the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability directly enables account takeover via spoofed email in the Helpdesk integration, which facilitates gaining and using valid accounts as described in T1078.