PT-2024-2473 · Jetbrains · Jetbrains Teamcity+1

Published 2024-03-27 · Updated 2025-11-24 · CVE-2024-31138

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.03

Description The issue is related to the configuration of the agent distribution in the JetBrains TeamCity system, which is a continuous integration and continuous delivery (CI/CD) platform. It allows for cross-site scripting (xSS) attacks due to inadequate protection of the web page structure. This could enable a remote attacker to perform inter-site scripting attacks.

Recommendations For versions prior to 2024.03, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Agent Distribution settings until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02451

CVE-2024-31138

ZDI-24-360

Affected Products

Jetbrains Teamcity

Teamcity

References · 12

• https://zerodayinitiative.com/advisories/ZDI-24-360 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31138 · Security Note
• https://bdu.fstec.ru/vul/2024-02451 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31138 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://jetbrains.com/help/teamcity/install-teamcity-agent.html · Note
• https://twitter.com/CVEnew/status/1773461393540583550 · Twitter Post
• https://t.me/CSIRT_italia/2931 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1773387138748297332 · Twitter Post
• https://github.com/advisories/GHSA-rxxr-85xg-h73w · Note
• https://t.me/csirt_italia/2414 · Telegram Post
• https://t.me/csirt_italia/2324 · Telegram Post