CVE-2024-47162: JetBrains YouTrack Information Disclosure

CVE-2024-47162 Overview

CVE-2024-47162 is an information disclosure vulnerability in JetBrains YouTrack versions prior to 2024.3.44799. The flaw exposes a sensitive token on the Imports page, allowing an unauthenticated network attacker to retrieve credential material without user interaction. The weakness maps to [CWE-522: Insufficiently Protected Credentials]. JetBrains fixed the issue in YouTrack 2024.3.44799.

Critical Impact
An attacker with network access can view a token exposed on the Imports page, enabling credential theft that supports further access to integrated systems.

Affected Products

JetBrains YouTrack versions before 2024.3.44799
YouTrack Server on-premises deployments running vulnerable builds
YouTrack instances with the Imports feature reachable over the network

Discovery Timeline

2024-09-19 - CVE-2024-47162 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47162

Vulnerability Analysis

CVE-2024-47162 is an information disclosure issue in the JetBrains YouTrack issue tracking platform. The Imports page renders a token in a manner that allows disclosure to a network-based requester. The exposed token can grant access to imported data sources or authenticated APIs used by the import workflow.

The vulnerability is classified under [CWE-522: Insufficiently Protected Credentials]. It affects confidentiality only; integrity and availability of the YouTrack service are not directly impacted. Exploitation requires no privileges and no user interaction, and the attack surface is reachable over the network. The EPSS probability is 0.355% at percentile 28.9, indicating low observed exploitation activity to date.

Root Cause

The root cause is the inclusion of sensitive credential material in the response served by the Imports page. Credentials handled by the import subsystem should be masked, redacted, or fetched through a server-side session rather than rendered in a manner that can be retrieved by an unauthorized viewer. The affected releases failed to enforce this control on the Imports view.

Attack Vector

An attacker interacts with the YouTrack Imports page over the network to retrieve the exposed token. Once obtained, the token can be replayed against systems that trust it, including source repositories, third-party trackers, or API endpoints referenced during imports. See the JetBrains Security Issues Fixed advisory for vendor context.

No public proof-of-concept exploit is available for CVE-2024-47162, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-47162

Indicators of Compromise

Unexpected outbound API calls from systems previously integrated with YouTrack imports, indicating potential token reuse
Access log entries showing requests to Imports-related endpoints from IP addresses outside expected administrative ranges
Unusual authentication events on systems whose credentials were configured within YouTrack import connectors

Detection Strategies

Inventory YouTrack builds and flag any instance running a version earlier than 2024.3.44799
Review web server and reverse proxy logs for reads of Imports page URLs by unauthenticated or low-privileged sessions
Correlate YouTrack access telemetry with authentication logs on integrated platforms to identify token replay patterns

Monitoring Recommendations

Ingest YouTrack application and access logs into a centralized analytics platform for retention and query
Alert on anomalous access to configuration and import endpoints, especially from non-administrative user agents
Rotate and monitor tokens issued to import connectors and treat any pre-patch token as potentially exposed

How to Mitigate CVE-2024-47162

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2024.3.44799 or later on all affected servers
Rotate every token that was configured in the Imports page prior to the upgrade
Audit third-party systems that trust YouTrack-issued tokens for unauthorized access following the exposure window

Patch Information

JetBrains fixed CVE-2024-47162 in YouTrack 2024.3.44799. Details are published on the JetBrains Security Issues Fixed page. Administrators of on-premises YouTrack should download the corrected build and apply it following JetBrains upgrade guidance. YouTrack Cloud instances are updated by JetBrains.

Workarounds

Restrict network access to the YouTrack Imports page using firewall rules or reverse proxy allowlists until the upgrade is complete
Temporarily disable or remove import configurations that reference high-value tokens
Enforce authentication and least-privilege access for all administrative pages exposed by YouTrack

bash

# Configuration example: restrict Imports endpoint at the reverse proxy
# nginx snippet limiting the Imports path to a trusted admin subnet
location /imports {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://youtrack_backend;
}