PT-2022-16616 · Jetbrains · Teamcity

Artem Godin · Published 2022-02-08 · Updated 2022-03-04 · CVE-2022-24333

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2

Description The issue allows for blind Server-Side Request Forgery (SSRF) via an XML-RPC call. This means an attacker could potentially force the server to make requests to arbitrary destinations, which could lead to internal network scanning or accessing services not intended for public exposure.

Recommendations For versions prior to 2021.2, update to version 2021.2 or later to resolve the issue. As a temporary workaround, consider restricting access to XML-RPC calls until a patch is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-24333

Affected Products

Teamcity

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-24333 · Security Note
• https://blog.jetbrains.com · Vendor Advisory
• https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24333 · Vendor Advisory
• https://t.me/cvenotify/27390 · Telegram Post
• https://t.me/cibsecurity/38103 · Telegram Post