Threat database

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

EPSS 0.2%VulnerabilityJetBrains#cwe-352Germany+8

In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions

EPSS 0.3%VulnerabilityJetBrains#cwe-1021Germany+8

In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible

EPSS 0.3%VulnerabilityJetBrains#cwe-862Germany+7

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

EPSS 1.2%VulnerabilityJetBrains#cwe-79Germany+9

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

EPSS 0.4%VulnerabilityJetBrains#cwe-862Germany+9

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

EPSS 36%VulnerabilityJetBrains#cwe-79Germany+7

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

EPSS 37%VulnerabilityJetBrains#cwe-79Germany+7

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

EPSS 1.0%VulnerabilityJetBrains#cwe-79Germany+7

In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible

EPSS 0.6%VulnerabilityJetBrains#cwe-77United States+9

CVE-2024-27199 is a path traversal vulnerability in JetBrains TeamCity versions before 2023.11.4. This flaw allows an unauthenticated attacker to perform limited administrative actions by exploiting improper input validation of file paths. The vulnerability has a CVSS score of 7.3, indicating high severity, with potential impacts on confidentiality, integrity, and availability. No official patch link is provided in the data, but the fixed version is identified as 2023.11.4. There are no known exploits in the wild at this time.

CVE-2024-27198 is a critical authentication bypass vulnerability in JetBrains TeamCity versions prior to 2023.11.4. This flaw, classified under CWE-288, allows unauthenticated attackers to perform administrative actions without proper authorization. The vulnerability has a CVSS v3.1 score of 9.8, indicating a severe risk with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the potential for abuse is significant given TeamCity’s role in continuous integration and deployment pipelines. Organizations using affected TeamCity versions should prioritize patching to prevent unauthorized access and potential compromise of build environments. Countries with substantial use of JetBrains TeamCity and strong software development sectors are at higher risk.

KEVEPSS 99%VulnerabilityJetBrains#cwe-288United States+10

JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.