Threats Tagged 'cve-2024-27198'

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and BypassBoss for privilege escalation. Earth Lamia's targets have shifted over time, initially focusing on financial services, then logistics and online retail, and recently IT companies, universities, and government organizations. The group employs various techniques including DLL sideloading, use of legitimate binaries, and development of modular backdoors. Earth Lamia's activities have been linked to other reported campaigns, suggesting a complex and evolving threat landscape.

MediumMalwareGermanyFranceNetherlands+5#cve-2024-56145#cve-2021-22205#cve-2024-27198

CVE-2024-27198 is a critical authentication bypass vulnerability in JetBrains TeamCity versions prior to 2023.11.4. This flaw, classified under CWE-288, allows unauthenticated attackers to perform administrative actions without proper authorization. The vulnerability has a CVSS v3.1 score of 9.8, indicating a severe risk with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the potential for abuse is significant given TeamCity’s role in continuous integration and deployment pipelines. Organizations using affected TeamCity versions should prioritize patching to prevent unauthorized access and potential compromise of build environments. Countries with substantial use of JetBrains TeamCity and strong software development sectors are at higher risk.

CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+8#cve#cve-2024-27198#cwe-288