PT-2024-2116 · Jetbrains · Teamcity

Published

2024-03-04

·

Updated

2026-04-20

·

CVE-2024-27199

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2023.11.4
Description The issue is related to path traversal, allowing limited admin actions to be performed. It is also associated with bypassing authentication procedures, potentially enabling remote attackers to execute arbitrary actions. The vulnerability may allow for the creation of an unauthorized admin account in the TeamCity server by bypassing 403 errors in the domain.
Recommendations For versions prior to 2023.11.4, update to version 2023.11.4 or later to resolve the issue. As a temporary workaround, consider restricting access to admin functionalities until the update is applied. Avoid using alternative paths or channels that could be exploited to bypass authentication.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23CWE-22

Related Identifiers

BDU:2024-02014
CVE-2024-27199

Affected Products

Teamcity