PT-2024-5490 · Jetbrains · Jetbrains Teamcity+1

Published 2024-07-22 · Updated 2024-08-14 · CVE-2024-41829

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.07

Description The issue is related to a configuration vulnerability in the JetBrains Space module Project Settings | Connections of the CI/CD system JetBrains TeamCity, which is connected to weaknesses in the authentication procedure. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability can be exploited via the Space Application connection, potentially allowing an attacker to steal an OAuth code for JetBrains Space.

Recommendations For versions prior to 2024.07, update to version 2024.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the Space Application connection to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

Related Identifiers

BDU:2024-06139

CVE-2024-41829

Affected Products

Jetbrains Teamcity

Teamcity

References · 8

• https://osv.dev/vulnerability/CVE-2024-41829 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41829 · Security Note
• https://jetbrains.com/help/teamcity/how-to-configure-cicd-for-jetbrains-space.html · Note
• https://t.me/cvenotify/90623 · Telegram Post
• https://t.me/cvenotify/87054 · Telegram Post
• https://t.me/cvedetector/1449 · Telegram Post