CVE-2024-27199: high-severity vulnerability in JetBrains TeamCity
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
JetBrains TeamCity versions before 2023.11.4 had a path traversal vulnerability that allowed attackers to bypass security restrictions and perform certain administrator actions they shouldn't have access to.
A path traversal vulnerability (CWE-23) in TeamCity before 2023.11.4 permitted attackers to traverse directory structures and execute limited administrative functions without proper authorization. The vulnerability required network access to the TeamCity instance but did not necessitate prior authentication for initial exploitation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.