CVE-2024-27198: critical vulnerability in JetBrains TeamCity
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
TeamCity versions before 2023.11.4 have an authentication bypass flaw that allows attackers to skip the login process and perform administrative actions without proper credentials.
An authentication bypass vulnerability in JetBrains TeamCity prior to 2023.11.4 (CWE-288) permits unauthenticated attackers to execute privileged administrative operations. The vulnerability requires network access to the TeamCity instance and results in complete compromise of system integrity and confidentiality.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.