DeutschShown in its original language — a full translation is planned for a future version.
JetBrains TeamCity: Mehrere Schwachstellen
view advisory published 2025-07-28
Ein Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-54538US | —OT elevated | — | ||
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command | ||||
| CVE-2025-54537US | —OT elevated | — | ||
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots | ||||
| CVE-2025-54536US | high8.8 | — | ||
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint | ||||
| CVE-2025-54535US | high7.5 | — | ||
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms | ||||
| CVE-2025-54534US | — | — | ||
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page | ||||
| CVE-2025-54533US | —OT elevated | — | ||
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration | ||||
| CVE-2025-54532US | —OT elevated | — | ||
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies | ||||
| CVE-2025-54531US | critical9.4 | — | ||
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows | ||||
| CVE-2025-54530US | critical9.8OT elevated | — | ||
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions | ||||
| CVE-2025-54529US | high7.5 | — | ||
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration | ||||
| CVE-2025-54528US | high8.8 | — | ||
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow | ||||
02
references
External citations — patches, advisories, analysis.
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
- NIST Vulnerability Database vom 2025-07-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan