PT-2024-5489 · Jetbrains · Jetbrains Teamcity+1

Published 2024-07-22 · Updated 2024-08-07 · CVE-2024-41828

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.07

Description The issue is related to a flaw in the authorization procedure of JetBrains TeamCity, a continuous integration and continuous deployment (CI/CD) system. This flaw arises from the non-constant time comparison of authorization tokens, which can be exploited by a remote attacker to impact the confidentiality of protected information.

Recommendations For versions prior to 2024.07, update to version 2024.07 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the system that rely on authorization tokens until the update can be applied.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

BDU:2024-06138

CVE-2024-41828

Affected Products

Jetbrains Teamcity

Teamcity

References · 6

• https://bdu.fstec.ru/vul/2024-06138 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41828 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41828 · Security Note
• https://t.me/cvenotify/87053 · Telegram Post
• https://t.me/cvedetector/1450 · Telegram Post