Lucene search

JetBrainsCVELIST:CVE-2022-40979

HistorySep 23, 2022 - 10:50 a.m.

CVE-2022-40979

2022-09-2310:50:08

CWE-532

JetBrains

www.cve.org

jetbrains

teamcity

logging

password

environmental variables

perforce

executable

4.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

In JetBrains TeamCity before 2022.04.4 environmental variables of “password” type could be logged when using custom Perforce executable

CNA Affected

[
  {
    "product": "TeamCity",
    "vendor": "JetBrains",
    "versions": [
      {
        "lessThan": "2022.04.4",
        "status": "affected",
        "version": "2022.04.4",
        "versionType": "custom"
      }
    ]
  }
]

References

www.jetbrains.com/privacy-security/issues-fixed/