CVE-2024-50580

Deeper analysis

CVE-2024-50580 is a cross-site scripting vulnerability affecting JetBrains YouTrack versions prior to 2024.3.47707. It stems from insecure markdown parsing combined with custom rendering rules, allowing multiple XSS vectors as classified under CWE-79. The issue carries a CVSS 3.1 score of 4.6 reflecting network attack vector, low complexity, and low-privileged access with user interaction required.

An authenticated attacker with low privileges can supply crafted markdown content that triggers script execution in other users' browsers upon rendering. Successful exploitation yields limited confidentiality and integrity impacts, such as session token theft or unauthorized actions within the victim's YouTrack context, but does not affect availability.

The vendor advisory at the referenced JetBrains security page addresses the flaw through the release of version 2024.3.47707, which corrects the markdown handling and rendering logic. The associated EPSS score remains flat at 0.2382 with no indicated rise after disclosure.