CVE-2023-42793: JetBrains TeamCity Authentication Bypass Vulnerability
First published: Tue Sep 19 2023(Updated: )
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Credit: security@jetbrains.com security@jetbrains.com ByteHunter
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jetbrains Teamcity | <2023.05.4 | |
| Jetbrains Teamcity | ||
| Jetbrains Teamcity | =2017.1 | |
| Jetbrains Teamcity | =2017.2 | |
| Jetbrains Teamcity | =2018.1 | |
| Jetbrains Teamcity | =2018.2 | |
| Jetbrains Teamcity | =2019.1 | |
| Jetbrains Teamcity | =2019.2 | |
| Jetbrains Teamcity | =2020.1 | |
| Jetbrains Teamcity | =2020.2 | |
| Jetbrains Teamcity | =2021.1 | |
| Jetbrains Teamcity | =2021.2 | |
| Jetbrains Teamcity | =2022.1 | |
| Jetbrains Teamcity | =2022.2 | |
| Jetbrains Teamcity | =2023.1 | |
| Jetbrains Teamcity | =2023.2 | |
| Jetbrains Teamcity | =2023.3 | |
| Jetbrains Teamcity | =2023.4 | |
| Jetbrains Teamcity | =2023.5 | |
| Jetbrains Teamcity | =2023.6 | |
| Jetbrains Teamcity | =2023.7 | |
| Jetbrains Teamcity | =2023.8 | |
| Jetbrains Teamcity | =2023.9 | |
| Jetbrains Teamcity | =2023.10 | |
| Jetbrains Teamcity | =2023.11 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
- https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/
- https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-new-teamcity-auth-bypass-vulnerability/
- https://www.theregister.com/2024/02/07/jetbrains_teamcity_critical_vuln/
- https://www.exploit-db.com/exploits/51884
Frequently Asked Questions
What is the vulnerability ID CVE-2023-42793?
The vulnerability ID CVE-2023-42793 refers to an authentication bypass vulnerability in JetBrains TeamCity before version 2023.05.4.
What is the severity of CVE-2023-42793?
The severity of CVE-2023-42793 is critical, with a severity value of 9.8.
How does CVE-2023-42793 impact JetBrains TeamCity?
CVE-2023-42793 allows for authentication bypass, leading to remote code execution (RCE) on the TeamCity Server.
What version of JetBrains TeamCity is affected by CVE-2023-42793?
CVE-2023-42793 affects all versions of JetBrains TeamCity before version 2023.05.4.
How can I fix the vulnerability CVE-2023-42793?
To fix CVE-2023-42793, update JetBrains TeamCity to version 2023.05.4 or later.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/remedy
- agent/title
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-23917
- alias/CVE-2023-42793
- agent/description
- collector/the-register
- source/The Register
- agent/references
- agent/event
- agent/news-ai
- agent/tags
- agent/softwarecombine
- collector/exploitdb-recent
- source/ExploitDB
- vendor/jetbrains
- canonical/jetbrains teamcity
- version/jetbrains teamcity/2017.1
- version/jetbrains teamcity/2017.2
- version/jetbrains teamcity/2018.1
- version/jetbrains teamcity/2018.2
- version/jetbrains teamcity/2019.1
- version/jetbrains teamcity/2019.2
- version/jetbrains teamcity/2020.1
- version/jetbrains teamcity/2020.2
- version/jetbrains teamcity/2021.1
- version/jetbrains teamcity/2021.2
- version/jetbrains teamcity/2022.1
- version/jetbrains teamcity/2022.2
- version/jetbrains teamcity/2023.1
- version/jetbrains teamcity/2023.2
- version/jetbrains teamcity/2023.3
- version/jetbrains teamcity/2023.4
- version/jetbrains teamcity/2023.5
- version/jetbrains teamcity/2023.6
- version/jetbrains teamcity/2023.7
- version/jetbrains teamcity/2023.8
- version/jetbrains teamcity/2023.9
- version/jetbrains teamcity/2023.10
- version/jetbrains teamcity/2023.11