JetBrains releases security fixes for TeamCity CI/CD system

Two critical security vulnerabilities discovered by Rapid7 could allow an attacker to gain administrative control of TeamCity On-Premises servers.

Editor at Large, InfoWorld |

Digital bugs amid binary code. [security threats / malware / breach / hack / attack]

JetBrains has released fixes for two critical security vulnerabilities in its TeamCity On-Premises CI/CD system discovered by cybersecurity company Rapid7.

The two vulnerabilities reported in late-February by Rapid7 would enable an authenticated attacker with HTTP(S) access to a TeamCity On-Premises server to bypass authentication checks and gain administrative control. These vulnerabilities affected all TeamCity On-Premises versions through 2023.11.3, but have been fixed in TeamCity On-Premises 2023.11.4. For users unable to update their server to version 2023.11.4, JetBrains also released a security patch plugin.

JetBrains urges TeamCity On-Premises customers to update to 2023.11.4 now or install the security patch immediately.

Next read this:

Paul Krill is an editor at large at InfoWorld, whose coverage focuses on application development.