CVE-2024-38506

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
JetBrainsYouTrack< 2024.2.34646

References

Timeline

Published
Jun 18, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleCVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an aCVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arCVE-2024-38515.4A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploadsCVE-2024-385107.2A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wiCVE-2024-385117.2A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user CVE-2024-385127.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform coCVE-2024-385139.8Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue iCVE-2024-385147.4NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of tCVE-2024-385168.8ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables inCVE-2024-385177.8Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `incluCVE-2024-385184.6BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to
CVE-2024-38506: High severity, CVSS 8.1 | Vulnix