CVE-2024-54158

LOW

Published Dec 4, 2024 Modified Jan 30, 2025 CWE-173 CWE-290

Description

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

Is your site exposed to CVE-2024-54158?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-173 CWE-173

CWE-290 CWE-290

Affected Products

Vendor	Product	Versions
jetbrains	youtrack	< 2024.3.52635

References

Advisories & Patches

https://www.jetbrains.com/privacy-security/issues-fixed/

Frequently Asked Questions

What is CVE-2024-54158? +

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding It has a CVSS v3.1 base score of 3.5 (LOW).

How severe is CVE-2024-54158? +

CVE-2024-54158 has a CVSS v3.1 score of 3.5 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-54158? +

CVE-2024-54158 affects products from jetbrains, specifically: youtrack. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-54158? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because …

CVE-2026-81638

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the …

CVE-2026-19611 7.4

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth …

CVE-2026-64813 10.0

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

CVE-2026-64812 10.0

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

CVE-2024-23917 9.8

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible