DeutschShown in its original language — a full translation is planned for a future version.
JetBrains TeamCity: Mehrere Schwachstellen
view advisory published 2024-05-30
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um beliebigen Code auszuführen, um einen Cross-Site Scripting Angriff durchzuführen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen und Dateien zu manipulieren.
01
describes (30)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-36470US | critical9.8OT elevated | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases | ||||
| CVE-2024-36378US | high7.5 | — | ||
In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens | ||||
| CVE-2024-36377US | high8.1OT elevated | — | ||
In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions | ||||
| CVE-2024-36376US | high8.1OT elevated | — | ||
In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions | ||||
| CVE-2024-36375US | medium5.3 | — | ||
In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed | ||||
| CVE-2024-36374US | medium5.4 | — | ||
In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible | ||||
| CVE-2024-36373US | medium5.4 | — | ||
In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible | ||||
| CVE-2024-36372US | medium6.1 | — | ||
In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible | ||||
| CVE-2024-36371US | medium5.4 | — | ||
In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible | ||||
| CVE-2024-36370US | medium5.4 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible | ||||
| CVE-2024-36369US | medium5.4 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible | ||||
| CVE-2024-36368US | medium5.4 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible | ||||
| CVE-2024-36367US | medium6.1 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible | ||||
| CVE-2024-36366US | medium6.1 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations | ||||
| CVE-2024-36365US | high8.1OT elevated | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent | ||||
| CVE-2024-36364US | medium6.5OT elevated | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible | ||||
| CVE-2024-36363US | medium5.4 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible | ||||
| CVE-2024-36362US | medium6.5 | — | ||
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible | ||||
| CVE-2024-35302US | medium6.1 | — | ||
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible | ||||
| CVE-2024-35301US | medium5.5 | — | ||
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token | ||||
showing 20 of 30
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan