CVE-2024-22370

Deeper analysis

CVE-2024-22370 is a stored cross-site scripting vulnerability (CWE-79) that affected JetBrains YouTrack versions prior to 2023.3.22666. The flaw allowed malicious markdown content to be persisted in the application and later rendered in other users' browsers, carrying a CVSS 3.1 score of 4.6.

An authenticated attacker with low privileges could craft and store markdown that executes script when viewed by another user who interacts with the affected page. Successful exploitation yields limited confidentiality and integrity impact within the victim's session but does not permit unauthenticated or fully automated compromise.

JetBrains addressed the issue in the 2023.3.22666 release, as noted in the vendor's security advisories. The EPSS score rose sharply from a low baseline to a peak of 0.2995 on 2025-12-11 before receding, indicating a period of increased exploitation interest after public disclosure.