PT-2024-3700 · Jetbrains · Teamcity

CVE-2024-35300 · Published 2024-05-16 · Updated 2024-12-16

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions 2024.03 through 2024.03.1

Description The issue exists due to inadequate protection of the web page structure in the CI/CD system, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. Several stored XSS vulnerabilities were found in the available updates page.

Recommendations For versions 2024.03 through 2024.03.1, consider disabling access to the available updates page as a temporary workaround until a patch is available. Restrict access to the available updates module to minimize the risk of exploitation. Avoid using the affected page until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04045

CVE-2024-35300

Affected Products

Teamcity

References · 6

• https://bdu.fstec.ru/vul/2024-04045 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35300 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35300 · Security Note
• https://t.me/cvenotify/79996 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1791093294866297253 · Twitter Post