CVE Vulnerabilities

CVE-2024-36470

Authentication Bypass Using an Alternate Path or Channel

Published: May 29, 2024 | Modified: Feb 07, 2025
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

Weakness

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected Software

Name Vendor Start Version End Version
Teamcity Jetbrains * 2022.04.7 (excluding)
Teamcity Jetbrains 2022.10 (including) 2022.10.6 (excluding)
Teamcity Jetbrains 2023.05 (including) 2023.05.6 (excluding)
Teamcity Jetbrains 2023.11 (including) 2023.11.5 (excluding)

Potential Mitigations

References