Veille CVE
CVE-2024-27198
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — JetBrains TeamCity Authentication Bypass Vulnerability
Ajoutée le 07/03/2024 · Échéance de correction (agences US) : 28/03/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | cve@jetbrains.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive Press/Media CoverageThird Party Advisory
- https://www.jetbrains.com/privacy-security/issues-fixed/ Vendor Advisory
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive Press/Media CoverageThird Party Advisory
- https://www.jetbrains.com/privacy-security/issues-fixed/ Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198 US Government Resource