WID-SEC-W-2025-2860

csafDEcert_bund

DeutschShown in its original language — a full translation is planned for a future version.

JetBrains TeamCity: Mehrere Schwachstellen

view advisory published 2025-12-16

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen und sich erweiterte Berechtigungen zu verschaffen.

01

describes (7)

Related CVEs.

IDseverity exploitable
CVE-2025-68268USmedium6.1—
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
CVE-2025-68267US——
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
CVE-2025-68166USmedium6.1—
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
CVE-2025-68165USmedium6.1—
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
CVE-2025-68164US——
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
CVE-2025-68163USmedium4.8—
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
CVE-2025-68162US——
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan