PT-2019-12665 · Jetbrains · Upsource+1

Published 2019-10-02 · Updated 2021-11-04 · CVE-2019-12156

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2018.2.5 JetBrains UpSource versions prior to 2018.2 build 1293

Description The issue allows server metadata to be exposed due to an error message that reflects the whole response back to the client.

Recommendations For JetBrains TeamCity versions prior to 2018.2.5, update to version 2018.2.5 or later. For JetBrains UpSource versions prior to 2018.2 build 1293, update to version 2018.2 build 1293 or later.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-12156

Affected Products

Teamcity

Upsource

References · 4

• https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12156 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12156 · Vendor Advisory
• https://t.me/cvenotify/22971 · Telegram Post