SB2025072963 - Multiple vulnerabilities in JetBrains TeamCity
Published: July 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Reversible One-Way Hash (CVE-ID: CVE-2025-54535)
The vulnerability allows a remote attacker to compromise passwords of application users.
The vulnerability exists due to usage of weak hashing algorithms. A remote attacker can reset password and take over accounts of application users.
2) Incorrect default permissions (CVE-ID: CVE-2025-54530)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.
3) Cross-site request forgery (CVE-ID: CVE-2025-54528)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in GitHub App connection flow. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
4) Incorrect authorization (CVE-ID: CVE-2025-54533)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect authorization checks. A remote attacker can obtain build settings via VCS configuration.
5) Cleartext storage of sensitive information (CVE-ID: CVE-2025-54537)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores user credentials in plain text in memory snapshots. A local user can obtain the snapshot contents and recover credentials.
6) Path traversal (CVE-ID: CVE-2025-54531)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences during plugin unpacking on Windows. A remote attacker can trick the victim into unpacking a specially crafted package and overwrite arbitrary files on the system.
7) Cleartext transmission of sensitive information (CVE-ID: CVE-2025-54538)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to software exposes password in clear text via command line in the "hg pull" command. A remote user can gain access to sensitive information.
8) Cross-site request forgery (CVE-ID: CVE-2025-54536)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin on GraphQL endpoint. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
9) Incorrect authorization (CVE-ID: CVE-2025-54532)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect authorization checks. A remote attacker can obtain build settings via snapshot dependencies.
10) Cross-site scripting (CVE-ID: CVE-2025-54534)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data on the agentpushPreset page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
11) Cross-site request forgery (CVE-ID: CVE-2025-54529)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in external OAuth login integration. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
Remediation
Install update from vendor's website.
References
- https://www.jetbrains.com/privacy-security/issues-fixed/#719fd72203b00dc66eec07d7178d4184
- https://www.jetbrains.com/privacy-security/issues-fixed/#386948e44b9fb0f9f8f9edfd5fb975d6
- https://www.jetbrains.com/privacy-security/issues-fixed/#c850d887a22cbe64e72383b845bf8fde
- https://www.jetbrains.com/privacy-security/issues-fixed/#36696403fd265f163671e6b3979ff153
- https://www.jetbrains.com/privacy-security/issues-fixed/#c5e4dfeaecd6358224c1f38e3df55ca2
- https://www.jetbrains.com/privacy-security/issues-fixed/#4e749cda999c16de14297c049c41634c
- https://www.jetbrains.com/privacy-security/issues-fixed/#b17a911bfda09036a49d79d897dcafbb
- https://www.jetbrains.com/privacy-security/issues-fixed/#7a36d569fdb0f4943dce0aa8fcd29eda
- https://www.jetbrains.com/privacy-security/issues-fixed/#cce4ce7522186a826eed52b880539f48
- https://www.jetbrains.com/privacy-security/issues-fixed/#d13f3e22a4fb8f9740331cc5cb924ed5
- https://www.jetbrains.com/privacy-security/issues-fixed/#acd3041a0f1bc2256c73d51829ab21eb