CVE-2023-42793: jetbrains teamcity

csirt@kutim:~/threat-intel/cve/CVE-2023-42793

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada jetbrains teamcity. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 4 Oktober 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Rincian

Terbit di NVD: 19 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: JetBrains TeamCity Authentication Bypass Vulnerability
Masuk KEV: 4 Oktober 2023
Tenggat CISA: 25 Oktober 2023 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jetbrains	teamcity	Semua versi sebelum 2023.05.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/ advisory vendor
https://www.jetbrains.com/privacy-security/issues-fixed/ advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793 pemerintah AS
http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793 advisory pihak ketiga
https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-tea... broken link · advisory pihak ketiga
https://www.sonarsource.com/blog/teamcity-vulnerability/ exploit · advisory pihak ketiga
https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/ press/media coverage

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.