What’s Vulnerable › Vulnerabilities
CVE-2024-27198: JetBrains TeamCity Authentication Bypass Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2024-03-07
- EPSS: 99.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-03-04 · updated 2026-06-17
- Weakness: CWE-288
Description
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Summary
JetBrains TeamCity before 2023.11.4 contains an authentication bypass that lets an unauthenticated attacker perform admin actions, rated CVSS 9.8 critical. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS puts 30-day exploitation probability at 99.9%. All TeamCity installations below 2023.11.4 are affected. Upgrade to 2023.11.4 or later immediately, or apply the vendor's mitigations or discontinue use if you cannot patch.
تحتوي JetBrains TeamCity قبل الإصدار 2023.11.4 على ثغرة تجاوز للمصادقة تتيح لمهاجم غير موثّق تنفيذ إجراءات إدارية، بتقييم خطورة 9.8 (حرجة). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 99.9%. تتأثر جميع نسخ TeamCity الأقدم من 2023.11.4. يجب الترقية فوراً إلى 2023.11.4 أو أحدث، أو تطبيق تخفيفات المورّد أو إيقاف استخدام المنتج إذا تعذّر الترقية.
Affected products
- JetBrains TeamCity: before 2023.11.4 — fixed in 2023.11.4
How to fix
Upgrade to a fixed version: JetBrains TeamCity 2023.11.4. Check the vendor advisory for mitigations.
References
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198
Get alerted when CVE-2024-27198 or the next vulnerability affects your stack