Type Vulnerability
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. Known-exploited catalogue reports exploitation in the wild.
JetBrains · Auth bypass
JetBrains TeamCity Relative Path Traversal Vulnerability
CVE-2024-27199
What this means
This is rated high severity (7.3 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Jetbrains Teamcity is in your estate, and treat that as the priority.
Full vendor description
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
Scoring and exploitation
7.3/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, and no one has to click or open anything. Low impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityLowC:L
IntegrityLowI:L
AvailabilityLowA:L
- Elevated attack likelihood (~100% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Known
- Listed product
- JetBrains TeamCity
Weaknesses
CWE-23CWE-22
Affected products ()
- Jetbrains Teamcity
Show the raw CPE strings (1)
- cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
References
6 links from the CVE record, grouped by site; the vendor's advisory comes first.
jetbrains.com1 linkVendor advisory
- issues-fixed (opens in a new tab)Vendor Advisory
darkreading.com1 link
github.com1 link
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource