CVE-2024-27198 JetBrains TeamCity Authentication Bypass
Attackers can bypass authentication to perform admin actions in JetBrains TeamCity, requiring an upgrade to secure the CI/CD pipeline.
- Exploited in the wild
- Since 7 Mar 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27198?
CVE-2024-27198 is a critical authentication bypass vulnerability in Jetbrains Teamcity, published on 4 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Weakness: CWE-288
Which versions are affected by CVE-2024-27198?
It affects 1 product.
Products include Jetbrains Teamcity.
How do I fix CVE-2024-27198?
No fix has been published for CVE-2024-27198 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Mar 2024.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-27198 being exploited?
Yes. Attackers have exploited CVE-2024-27198 in the wild since at least 7 Mar 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 20 proofs of concept on GitHub.
Other vulnerabilities in Jetbrains Teamcity
Sources
Also known as GHSA-xh94-49wq-7h2h.