CVE-2019-12157

Published: Oct 2, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.

Affected (6)

Products: Jetbrains: Teamcity, Upsource

2 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Teamcity	Before 2018.2.5
Jetbrains Upsource	Up to 2018.2
Jetbrains Upsource	Version 2018.2 build_1013
Jetbrains Upsource	Version 2018.2 build_1141
Jetbrains Upsource	Version 2018.2 build_1154
Jetbrains Upsource	Version 2018.2 build_1291

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/

Source: cve@mitre.org

Vendor Advisory

https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.