Access Token Management Flaw in JetBrains TeamCity
CVE-2024-56351

8.8HIGH

Key Information:

Vendor

JetBrains
Status
Teamcity
Vendor
CVE Published:
20 December 2024

What is CVE-2024-56351?

CVE-2024-56351 identifies a significant security vulnerability in JetBrains TeamCity up to version 2024.11, where access tokens remain active even after a user’s roles are revoked. This oversight allows malicious actors to maintain unauthorized access to sensitive functions and data within the application, leading to potential data breaches or manipulation. Users of affected versions are strongly urged to apply the latest security updates to mitigate the risks associated with this vulnerability, as it poses a serious threat to the integrity of user access controls.

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.