#VU24837 Insufficiently protected credentials in TeamCity


Published: 2020-02-03

Vulnerability identifier: #VU24837

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7909

CWE-ID: CWE-522

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TeamCity
Web applications / CRM systems

Vendor: JetBrains s.r.o.

Description

The vulnerability allows a remote attacker to obtain the administrator credentials.

The vulnerability exist due to the server-stored passwords can be shown via the web UI. A remote attacker can gain access to sensitive information on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

TeamCity: 2017.1 - 2019.1.4

External links
http://blog.jetbrains.com
http://blog.jetbrains.com/blog/2020/01/24/jetbrains-security-bulletin-q4-2019/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in JetBrains TeamCity