JetBrains TeamCity vulnerabilities

In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.

In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.

In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.

In JetBrains TeamCity versions before 2023.05, an open redirect vulnerability during oAuth configuration was present.

In JetBrains TeamCity before version 2023.05, 'password' type parameters from build dependencies could be logged in some cases.

In JetBrains TeamCity before version 2023.05, an XSS vulnerability was possible in the Plugin Vendor URL.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability existed on the 'Show Connection' page.

In JetBrains TeamCity versions before 2023.05, improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API.