Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten oder um Sicherheitsmaßnahmen zu umgehen.
Product
TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.
Vulnerabilities 3
-
Medium 5.5
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
-
Medium 5.4
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
-
Low 3.5
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
Revision history
-
#1
Initiale Fassung
References
-
National Vulnerability Database CVE-2024-35300 vom 2024-05-15
https://nvd.nist.gov/vuln/detail/CVE-2024-35300
-
National Vulnerability Database CVE-2024-35301 vom 2024-05-15
https://nvd.nist.gov/vuln/detail/CVE-2024-35301
-
National Vulnerability Database CVE-2024-35302 vom 2024-05-15
https://nvd.nist.gov/vuln/detail/CVE-2024-35302
-
JetBrains Security Updates vom 2024-05-15
https://www.jetbrains.com/privacy-security/issues-fixed/