CVE-2022-46831

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.jetbrains.com/privacy-security/issues-fixed/	Vendor Advisory
https://www.jetbrains.com/privacy-security/issues-fixed/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:31

Type	Values Removed	Values Added
References	~~() https://www.jetbrains.com/privacy-security/issues-fixed/ - Vendor Advisory~~	() https://www.jetbrains.com/privacy-security/issues-fixed/ - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.9~~	v2 : unknown v3 : 6.6

12 Dec 2022, 16:33

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-12-08 18:15

Updated : 2024-11-21 07:31

NVD link : CVE-2022-46831

Mitre link : CVE-2022-46831

CVE.ORG link : CVE-2022-46831

JSON object : View

Products Affected

jetbrains

teamcity

CWE

CWE-453

Insecure Default Variable Initialization

CWE-1188

Insecure Default Initialization of Resource

{"id": "CVE-2022-46831", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@jetbrains.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2022-12-08T18:15:10.367", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["Vendor Advisory"], "source": "cve@jetbrains.com"}, {"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@jetbrains.com", "description": [{"lang": "en", "value": "CWE-453"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the \"Default Credential Provider Chain\" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators."}, {"lang": "es", "value": "En JetBrains TeamCity, entre 2022.10 y 2022.10.1, la conexi\u00f3n a AWS mediante la \"Cadena de proveedor de credenciales predeterminada\" permiti\u00f3 a los administradores de proyectos de TeamCity acceder a los recursos de AWS normalmente limitados a los administradores del sistema de TeamCity."}], "lastModified": "2024-11-21T07:31:08.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10C10FCE-8511-4D07-9CDD-BC1C76A52DBD", "versionEndIncluding": "2022.10.1", "versionStartIncluding": "2022.10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@jetbrains.com"}