Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
Product
TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.
Vulnerabilities 9
-
Medium 6.3
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
-
Medium 5.9
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
-
Medium 5.5
In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
-
Medium 5.5
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
-
Medium 5.3
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
-
Medium 4.6
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
-
Medium 4.6
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
-
Medium 4.3CVE-2024-56348 Public exploit
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
-
Medium 4.3
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
Revision history
-
#1
Initiale Fassung
References
-
JrtBrains Fixed security issues vom 2024-12-22
https://www.jetbrains.com/privacy-security/issues-fixed/