CVE-2024-35299: 
YouTrack vulnerability analysis and mitigation

In JetBrains YouTrack before version 2024.1.29548, a security vulnerability was identified where the SMTPS protocol communication lacked proper certificate hostname validation. The vulnerability was disclosed on May 16, 2024, and was assigned the identifier CVE-2024-35299 (NVD).

The vulnerability is classified as CWE-295 (Improper Certificate Validation). According to the National Vulnerability Database, it received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while JetBrains assessed it with a score of 5.9 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could potentially expose sensitive information during SMTPS protocol communication due to the lack of proper certificate hostname validation, primarily affecting the confidentiality of the system (NVD).

The vulnerability is remotely exploitable (Network attack vector) with no privileges required. While JetBrains rates the attack complexity as High, NIST assessment indicates Low attack complexity (NVD).

The vulnerability has been addressed in JetBrains YouTrack version 2024.1.29548. Users are advised to upgrade to this version or later to mitigate the security risk (Vendor Advisory).