CVE-2023-42793

2023-09-2700:00:00

attackerkb.com

jetbrains teamcity

authentication bypass

rce

server

vulnerability

exploitability

supply chain attack

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.972 High

EPSS

Percentile

99.8%

JSON

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Recent assessments:

sfewer-r7 at September 27, 2023 1:47pm UTC reported:

Based on the accompanying Rapid7 Analysis, the attacker value for CVE-2023-42793 is very high given the target product is a CI/CD server, and as such may contain sanative information such as source code or signing keys, in addition to being a vector for conducting a supply chain attack. The exploitability for this vulnerability is also very high, as the product is vulnerable in a default configuration and an attacker can trivially exploit it with a sequence of cURL commands.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5