CVE-2025-24458
Published: 21 January 2025
Summary
CVE-2025-24458 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Jetbrains Youtrack. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of JetBrains YouTrack to version 2024.3.55417 or later, eliminating the account takeover flaw.
Validates information inputs from spoofed emails in the Helpdesk integration to prevent processing of forged sender data leading to account takeover.
Implements spam protection at email entry points to filter and block spoofed emails targeting the YouTrack Helpdesk integration.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables account takeover via spoofed email in the Helpdesk integration, which facilitates gaining and using valid accounts as described in T1078.
NVD Description
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
Deeper analysisAI
CVE-2025-24458 affects JetBrains YouTrack in versions before 2024.3.55417, where account takeover is possible via spoofed email and Helpdesk integration. Published on 2025-01-21, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and maps to CWE-290.
The attack requires local access (AV:L) with low complexity (AC:L), no privileges (PR:N), and user interaction (UI:R). An unauthenticated attacker can spoof an email through the Helpdesk integration to achieve account takeover, resulting in high impacts to confidentiality and integrity but no availability disruption.
JetBrains has fixed the issue in YouTrack 2024.3.55417. For mitigation details, refer to the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/.
Details
- CWE(s)