critical9.8Known exploitedPublic exploit code
CVE-2023-42793
JetBrains TeamCity Authentication Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-10-04. Federal due date: 2023-10-25.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)2024-03-14 · remote · java
Impact
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jetbrains | Teamcity | before 2023.05.4 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
- https://www.sonarsource.com/blog/teamcity-vulnerability/
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793