CVE-2024-27199 : In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limite

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

Published 2024-03-04 18:15:09

Updated 2024-12-16 14:56:41

Source JetBrains s.r.o.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2024-27199

Jetbrains » Teamcity
Versions before (<) 2023.11.4
cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

94.50%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	3.9	3.4	JetBrains s.r.o.	2024-03-04
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	3.9	3.4	NIST	2024-12-16
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)
CWE-23 Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Assigned by: cve@jetbrains.com (Secondary)

Jump to