CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31138 – JetBrains TeamCity AgentDistributionSettingsController Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2024-31138
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings En JetBrains TeamCity antes de 2024.03, xSS era posible a través de la configuración de Distribución de agentes This vulnerability allows remote attackers to execute arbitrary script on affected installations of JetBrains TeamCity. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the os parameter provided to the AgentDistributionSettingsController.doPost method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to execute script in the context of the current user. • https://www.jetbrains.com/privacy-security/issues-fixed • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31137
https://notcve.org/view.php?id=CVE-2024-31137
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration En JetBrains TeamCity antes de 2024.03 se reflejaba que XSS era posible a través de la configuración de conexión espacial • https://www.jetbrains.com/privacy-security/issues-fixed • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31136
https://notcve.org/view.php?id=CVE-2024-31136
In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter En JetBrains TeamCity antes de 2024.03, 2FA se podía omitir proporcionando un parámetro de URL especial • https://www.jetbrains.com/privacy-security/issues-fixed • CWE-1288: Improper Validation of Consistency within Input •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31135
https://notcve.org/view.php?id=CVE-2024-31135
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page En JetBrains TeamCity antes de 2024.03, era posible abrir la redirección en la página de inicio de sesión • https://www.jetbrains.com/privacy-security/issues-fixed • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31134
https://notcve.org/view.php?id=CVE-2024-31134
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled En JetBrains TeamCity antes de 2024.03, los usuarios autenticados sin permisos administrativos podían registrar a otros usuarios cuando el registro automático estaba deshabilitado. • https://www.jetbrains.com/privacy-security/issues-fixed • CWE-863: Incorrect Authorization •