Medium WID-SEC-2023-2827 4 CVEs

JetBrains TeamCity: Mehrere Schwachstellen

Published Nov 5, 2023 · Updated Nov 5, 2023 · de-DE

Vendor: JetBrains Product: TeamCity Product: TeamCity < 2023.05 Product: TeamCity < 2023.05.3 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.

Vulnerabilities 4

Medium 4.8

CVE-2023-34224

In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

JetBrains TeamCity

May 31, 2023
Medium 4.6

CVE-2023-41248

In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration

JetBrains TeamCity

Aug 25, 2023
Medium 4.6

CVE-2023-41249 EPSS 56%

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

JetBrains TeamCity

Aug 25, 2023
Low 3.5

CVE-2023-41250

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration

JetBrains TeamCity

Aug 25, 2023

Revision history

2023-11-05 #1
Initiale Fassung

References

GitHub Advisory Database vom 2023-11-05
https://github.com/advisories/GHSA-x5cr-9j64-xrx5
GitHub Advisory Database vom 2023-11-05
https://github.com/advisories/GHSA-h8pg-5qr6-rgvg
GitHub Advisory Database vom 2023-11-05
https://github.com/advisories/GHSA-4qj9-xpvr-86r7
GitHub Advisory Database vom 2023-11-05
https://github.com/advisories/GHSA-4c37-p59v-2r8g