{"id":"CVE-2024-27199","published":"2024-03-04T18:15:09Z","modified":"2026-06-17T07:19:25Z","title":"JetBrains TeamCity Relative Path Traversal Vulnerability","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"description":{"text":"In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions  was possible","provenance":"source","from":"NVD"},"summary":{"text":"A relative path traversal flaw in JetBrains TeamCity, affecting versions before 2023.11.4, allows limited administrative actions to be performed. An attacker with network access can exploit it without authentication or user interaction, and the attack requires no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:20Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.99991,"percentile":0.99985,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-04-20","dueDate":"2026-05-04","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jetbrains.com/privacy-security/issues-fixed/ ; https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27199","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-03-05","exploitedFirstSeen":"2024-03-05","ransomware":true,"evidence":[{"url":"https://attackerkb.com/topics/ADUie1mrpK/cve-2024-27199#exploited-in-the-wild_e28f53e6-cf6f-4b91-89be-6cb19dfd4315","date":"2024-03-05"},{"url":"https://blog.jetbrains.com/teamcity/2024/03/preventing-exploits-jetbrains-ethical-approach-to-vulnerability-disclosure/","date":"2024-03-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-17&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-18&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-19&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-19"},{"url":"https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html","date":"2024-03-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-20&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-21&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-22&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-23&host_type=src&vulnerability=cve-2024-27199","date":"2024-03-23"}],"evidenceTotal":508,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","tags":["Press/Media Coverage"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","tags":["Press/Media Coverage"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Public-facing TeamCity exploited via path traversal","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"path traversal allowing to perform limited admin actions  was possible","start":39,"end":109}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Yields limited administrative actions on the server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allowing to perform limited admin actions  was possible","start":54,"end":109}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-24438","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24438","exploited":true,"exploitedSince":"2026-04-20","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-27199","name":"TeamCity < 2023.11.4 - Authentication Bypass","severity":"high","path":"http/cves/2024/CVE-2024-27199.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27199.yaml"}],"provenance":"source"},"exploitRefs":["https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2024-03-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27199","provenance":"source"},{"date":"2024-03-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://attackerkb.com/topics/ADUie1mrpK/cve-2024-27199#exploited-in-the-wild_e28f53e6-cf6f-4b91-89be-6cb19dfd4315","provenance":"source"},{"date":"2026-04-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24438","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":777},"priority":{"score":75.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 971 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}