PT-2024-7653 · Jetbrains · Jetbrains Teamcity+1

Published 2024-10-08 · Updated 2024-10-11 · CVE-2024-47161

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.07.3

Description The issue is related to insufficient protection of registration data in the JetBrains TeamCity continuous integration and delivery (CI/CD) system. Exploitation of this issue could allow a remote attacker to expose a user's password through the Sonar runner REST API, specifically the /api endpoint, by accessing the password variable.

Recommendations For versions prior to 2024.07.3, update to version 2024.07.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Sonar runner REST API to minimize the risk of exploitation. Avoid using the password variable in the affected API endpoint until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2024-09096

CVE-2024-47161

Affected Products

Jetbrains Teamcity

Teamcity

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-47161 · Security Note
• https://jetbrains.com/privacy-security/issues-fixed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47161 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09096 · Security Note
• https://t.me/cvedetector/7368 · Telegram Post
• https://twitter.com/CVEnew/status/1843688032026931713 · Twitter Post