CVE-2023-42793

🗓️ 19 Sep 2023 16:57:29Reported by JetBrainsType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 3355 Views🌐 WEB

JetBrains TeamCity authentication bypass leading to RC

Reporter	Title	Published	Views	Family All 81
zdt	JetBrains TeamCity Unauthenticated Remote Code Execution Exploit	2 Oct 202300:00	–	zdt
zdt	JetBrains TeamCity 2023.05.3 - Remote Code Execution Exploit	14 Mar 202400:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	24 Apr 202416:33	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	7 Jan 202422:29	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	20 Sep 202412:15	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	21 Apr 202413:52	–	githubexploit
GithubExploit	CVE-CICD-Security	13 Aug 202611:38	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	21 Apr 202413:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	5 Jul 202417:39	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity	24 Aug 202417:17	–	githubexploit

NVD

Vulners

Node

jetbrains teamcityRange<2023.05.4

[
  {
    "vendor": "JetBrains",
    "product": "TeamCity",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2023.05.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
blog	www.blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
packetstormsecurity	www.packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
sonarsource	www.sonarsource.com/blog/teamcity-vulnerability/
securityweek	www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
attackerkb	www.attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
jetbrains	www.jetbrains.com/privacy-security/issues-fixed/
rapid7	www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	request body	/app/rest/users	Endpoint used to create a new user; the PoC leverages it to create a SYSTEM_ADMIN/admin user enabling RCE.	CWE-306, CWE-288
password	request body	/app/rest/users	Endpoint used to create a new user; the PoC leverages it to create a SYSTEM_ADMIN/admin user enabling RCE.	CWE-306, CWE-288
email	request body	/app/rest/users	Endpoint used to create a new user; the PoC leverages it to create a SYSTEM_ADMIN/admin user enabling RCE.	CWE-306, CWE-288
roles	request body	/app/rest/users	Endpoint used to create a new user; the PoC leverages it to create a SYSTEM_ADMIN/admin user enabling RCE.	CWE-306, CWE-288

17 Jun 2026 06:24Current

9.6Critical risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.99988

SSVC

cve-2023-42793 jetbrains teamcity authentication bypass rce nvd