CVE-2024-27198

CVE-2024-27198 is a critical-severity (CVSS 9.8) vulnerability in JetBrains TeamCity. CISA added it to the Known Exploited Vulnerabilities catalog on March 7, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 28, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. JetBrains has 4 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
• https://www.jetbrains.com/privacy-security/issues-fixed/
• https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
• https://www.jetbrains.com/privacy-security/issues-fixed/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198