Summary
Ein entfernter authentisierter oder anonymer Angreifer, oder ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Informationen offenzulegen, einen Cross-Site-Scripting-Angriff zu starten, die Autorisierung zu umgehen und einen Denial-of-Service-Zustand zu erzeugen.
Product
TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.
Vulnerabilities 6
-
High 7.4
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
-
Medium 6.4
In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific c…
-
Medium 4.6
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
-
Low 3.5
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
-
Low 3.5
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
-
Low 2.6
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
Revision history
-
#1
Initiale Fassung
References
-
JetBrains TeamCity Fixed security issues vom 2024-07-22
https://www.jetbrains.com/privacy-security/issues-fixed/?product=TeamCity&version=2024.07
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41824
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41825
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41826
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41827
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41828
-
NIST Vulnerability Database vom 2024-07-22
https://nvd.nist.gov/vuln/detail/CVE-2024-41829