PT-2022-27989 · Jetbrains · Teamcity

Published 2022-12-08 · Updated 2022-12-12 · CVE-2022-46831

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions 2022.10 through 2022.10.1

Description The issue allows TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators when connecting to AWS using the "Default Credential Provider Chain".

Recommendations For versions 2022.10 through 2022.10.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to AWS resources for project administrators until a patch is available.

Fix

Weakness Enumeration

CWE-453

CWE-1188

Related Identifiers

CVE-2022-46831

Affected Products

Teamcity

References · 6

• https://osv.dev/vulnerability/CVE-2022-46831 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46831 · Security Note
• https://t.me/cibsecurity/54189 · Telegram Post
• https://t.me/cvenotify/39456 · Telegram Post
• https://t.me/cvenotify/39473 · Telegram Post