Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen und sich erweiterte Berechtigungen zu verschaffen.
Product
TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.
Vulnerabilities 7
-
Medium 6.5
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token i…
-
Medium 5.4
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
-
Medium 5.4
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
-
Medium 5.4
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
-
Low 3.5
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
-
Low 2.7
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
-
Low 2.7
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
Revision history
-
#2
doppelte Eintragung bereinigt
-
#1
Initiale Fassung
References
-
JetBrains Fixed security issues vom 2025-12-16
https://www.jetbrains.com/privacy-security/issues-fixed/
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68162
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68163
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68164
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68165
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68166
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68267
-
NIST Vulnerability Database vom 2025-12-16
https://nvd.nist.gov/vuln/detail/CVE-2025-68268