Skip to content
OpenAdvisories
Medium WID-SEC-2024-0756 7 CVEs

JetBrains TeamCity: Mehrere Schwachstellen

Published Apr 1, 2024 · Updated Nov 27, 2024 · Revision 2 · de-DE

Vendor: JetBrains Product: TeamCity Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Daten zu manipulieren, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.

Vulnerabilities 7

  • High 7.4
    CVE-2024-31136

    In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter

    JetBrains TeamCity
  • Medium 6.8
    CVE-2024-31137

    In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration

    JetBrains TeamCity
  • Medium 6.5
    CVE-2024-31134

    In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users …

    JetBrains TeamCity
  • Medium 6.1
    CVE-2024-31135

    In JetBrains TeamCity before 2024.03 open redirect was possible on the login page

    JetBrains TeamCity
  • Medium 5.9
    CVE-2024-31139

    In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

    JetBrains TeamCity
  • Medium 4.6
    CVE-2024-31138 EPSS 75%

    In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

    JetBrains TeamCity
  • Medium 4.1
    CVE-2024-31140

    In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing t…

    JetBrains TeamCity

Revision history

  1. #2

    Produktzuordnung überprüft

  2. #1

    Initiale Fassung

References