CVE-2023-42793

🗓️ 19 Sep 2023 16:57:29Reported by JetBrainsType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 3195 Views🌐 WEB

JetBrains TeamCity authentication bypass leading to RC

Reporter	Title	Published	Views	Family All 61
0day.today	JetBrains TeamCity Unauthenticated Remote Code Execution Exploit	2 Oct 202300:00	–	zdt
0day.today	JetBrains TeamCity 2023.05.3 - Remote Code Execution Exploit	14 Mar 202400:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	24 Apr 202416:33	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	7 Jan 202422:29	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	20 Sep 202412:15	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	21 Apr 202413:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	21 Apr 202413:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	5 Jul 202417:39	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	24 Aug 202417:17	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	5 Oct 202318:12	–	githubexploit

NVD

Node

jetbrains teamcityRange<2023.05.4

[
  {
    "vendor": "JetBrains",
    "product": "TeamCity",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2023.05.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
securityweek	www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
attackerkb	www.attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
jetbrains	www.jetbrains.com/privacy-security/issues-fixed/
rapid7	www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
sonarsource	www.sonarsource.com/blog/teamcity-vulnerability/
blog	www.blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
packetstormsecurity	www.packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	request body	app/rest/users	JetBrains TeamCity admin user creation via REST leading to privilege escalation/RCE	CWE-288, CWE-306
password	request body	app/rest/users	JetBrains TeamCity admin user creation via REST leading to privilege escalation/RCE	CWE-288, CWE-306
email	request body	app/rest/users	JetBrains TeamCity admin user creation via REST leading to privilege escalation/RCE	CWE-288, CWE-306
roles	request body	app/rest/users	JetBrains TeamCity admin user creation via REST leading to privilege escalation/RCE	CWE-288, CWE-306

24 Oct 2025 20:48Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.99979

SSVC

cve-2023-42793 jetbrains teamcity authentication bypass rce nvd