DeutschShown in its original language — a full translation is planned for a future version.
JetBrains TeamCity: Mehrere Schwachstellen
view advisory published 2024-04-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Daten zu manipulieren, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-31140US | medium4.9 | — | ||
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools | ||||
| CVE-2024-31139US | high8.1 | — | ||
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector | ||||
| CVE-2024-31138US | medium5.4 | — | ||
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings | ||||
| CVE-2024-31137US | medium6.1 | — | ||
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration | ||||
| CVE-2024-31136US | high7.4 | — | ||
In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter | ||||
| CVE-2024-31135US | medium6.1 | — | ||
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page | ||||
| CVE-2024-31134US | medium6.5OT elevated | — | ||
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan