CVE-2021-27733: 
YouTrack vulnerability analysis and mitigation

CVE-2021-27733 is a stored Cross-Site Scripting (XSS) vulnerability that affected JetBrains YouTrack. The vulnerability was discovered and reported by Mikhail Klyuchnikov and was fixed in version 2020.6.6441. The vulnerability allowed attackers to perform stored XSS attacks via an attached file (JetBrains Blog).

The vulnerability was classified as having Medium severity and affected the file attachment functionality in YouTrack. The issue involved insufficient sanitization of file attachments, which could be exploited to inject malicious scripts that would be stored and executed when other users accessed the affected content (JetBrains Blog).

The vulnerability could allow attackers to execute arbitrary web scripts in the context of other users' browsers who accessed the compromised content. This could potentially lead to session hijacking, defacement of the web interface, or theft of sensitive information (JetBrains Blog).

The vulnerability required an attacker to have the ability to upload files to the YouTrack instance. Once exploited, the malicious script would be stored and executed when other users accessed the content containing the compromised file attachment (JetBrains Blog).

The vulnerability was patched in YouTrack version 2020.6.6441. Users are advised to upgrade to this version or later to protect against this security issue. No workarounds were published for users unable to upgrade immediately (JetBrains Blog).