Skip to content
OpenAdvisories
Medium WID-SEC-2025-1666 11 CVEs

JetBrains TeamCity: Mehrere Schwachstellen

Published Jul 28, 2025 · Updated Jul 28, 2025 · de-DE

Vendor: JetBrains Product: TeamCity Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.

Vulnerabilities 11

  • High 7.7
    CVE-2025-54531

    In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

    JetBrains TeamCity
  • High 7.5
    CVE-2025-54530

    In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

    JetBrains TeamCity
  • Medium 5.8
    CVE-2025-54535

    In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

    JetBrains TeamCity
  • Medium 5.5
    CVE-2025-54537

    In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

    JetBrains TeamCity
  • Medium 5.5
    CVE-2025-54538

    In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

    JetBrains TeamCity
  • Medium 5.4
    CVE-2025-54528

    In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

    JetBrains TeamCity
  • Medium 5.4
    CVE-2025-54536

    In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

    JetBrains TeamCity
  • Medium 4.8
    CVE-2025-54534

    In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

    JetBrains TeamCity
  • Medium 4.3
    CVE-2025-54532

    In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependen…

    JetBrains TeamCity
  • Medium 4.3
    CVE-2025-54533

    In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

    JetBrains TeamCity
  • Low 3.7
    CVE-2025-54529

    In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

    JetBrains TeamCity

Revision history

  1. #1

    Initiale Fassung

References