Improper Certificate Validation in TeamCity - CVE-2019-15042
Published: October 1, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU35200
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-15042
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
Affected software
TeamCity
How to mitigate CVE-2019-15042
Install update from vendor's website.