CVE-2024-27198

🗓️ 04 Mar 2024 17:21:39Reported by JetBrainsType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 674 Views🌐 WEB

JetBrains TeamCity authentication bypass CVE-2024-2719

Reporter	Title	Published	Views	Family All 91
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	1 Jul 202601:36	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	18 May 202612:49	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Oct 202413:36	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Mar 202422:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Oct 202413:36	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	8 Mar 202412:40	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	17 Dec 202515:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	9 Mar 202404:04	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	18 Oct 202516:45	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity	4 Mar 202422:44	–	githubexploit

NVD

Vulners

Vulnrichment

Node

jetbrains teamcityRange<2023.11.4

[
  {
    "vendor": "JetBrains",
    "product": "TeamCity",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "2023.11.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
darkreading	www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
jetbrains	www.jetbrains.com/privacy-security/issues-fixed/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	path	/idontexist?jsp=/app/rest/users;.jsp	Path traversal-like technique bypassing authentication to gain admin privileges via REST endpoint	CWE-288
password	path	/idontexist?jsp=/app/rest/users;.jsp	Path traversal-like technique bypassing authentication to gain admin privileges via REST endpoint	CWE-288
email	path	/idontexist?jsp=/app/rest/users;.jsp	Path traversal-like technique bypassing authentication to gain admin privileges via REST endpoint	CWE-288
roles	path	/idontexist?jsp=/app/rest/users;.jsp	Path traversal-like technique bypassing authentication to gain admin privileges via REST endpoint	CWE-288

17 Jun 2026 07:19Current

9.6Critical risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.99938

SSVC