CVE-2024-27198

🗓️ 04 Mar 2024 17:21:39Reported by JetBrainsType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 568 Views🌐 WEB

JetBrains TeamCity authentication bypass CVE-2024-2719

Reporter	Title	Published	Views	Family All 71
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	18 May 202612:49	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Oct 202413:36	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Mar 202422:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Oct 202413:36	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	8 Mar 202412:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	17 Dec 202515:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Mar 202404:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	18 Oct 202516:45	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	4 Mar 202422:44	–	githubexploit
GithubExploit	Exploit for CVE-2024-30851	4 Apr 202422:59	–	githubexploit

NVD

Node

jetbrains teamcityRange<2023.11.4

[
  {
    "vendor": "JetBrains",
    "product": "TeamCity",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2023.11.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
darkreading	www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
jetbrains	www.jetbrains.com/privacy-security/issues-fixed/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	request body	/idontexist?jsp=/app/rest/users;.jsp	Authentication bypass via path traversal-like JSP handling combined with REST endpoint (CVE-2024-27198)	CWE-288
password	request body	/idontexist?jsp=/app/rest/users;.jsp	Authentication bypass via path traversal-like JSP handling combined with REST endpoint (CVE-2024-27198)	CWE-288
email	request body	/idontexist?jsp=/app/rest/users;.jsp	Authentication bypass via path traversal-like JSP handling combined with REST endpoint (CVE-2024-27198)	CWE-288
roles	request body	/idontexist?jsp=/app/rest/users;.jsp	Authentication bypass via path traversal-like JSP handling combined with REST endpoint (CVE-2024-27198)	CWE-288

24 Oct 2025 20:48Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.93047

SSVC