CVE-2024-36470

Published: May 29, 2024Modified: Feb 7, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

Affected (4)

Products: Jetbrains: Teamcity

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Teamcity	Before 2022.04.7
Jetbrains Teamcity	From 2022.10 to 2022.10.6
Jetbrains Teamcity	From 2023.05 to 2023.05.6
Jetbrains Teamcity	From 2023.11 to 2023.11.5

Related CWEs

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Issue TrackingVendor Advisory

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.