First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-28230

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	YouTrack	< 2024.1.25893

References

Timeline

Published: Mar 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-282317.5eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0 CVE-2024-282327.5Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the user CVE-2024-282336.1JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker c CVE-2024-282344.7Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inj CVE-2024-282356.5Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for bro CVE-2024-282366.5Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable subst CVE-2024-282374.8OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerabi CVE-2024-282382.3Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET requ CVE-2024-282394.3Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can CVE-2024-28246.3A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the CVE-2024-282407.8The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow CVE-2024-282417.8The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent l

CVE-2024-28230: Medium severity, CVSS 6.5 | Vulnix