{"id":"CVE-2023-42793","kind":"vulnerability","aliases":["CVE-2023-42793"],"related":[],"title":"In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible","description":"JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"JetBrains TeamCity Server has an authentication bypass that lets an unauthenticated remote attacker run code on the server. CISA lists it as actively exploited in the wild, with ransomware use noted in the sources.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-10-04T00:00:00+00:00","products":[{"name":"jetbrains teamcity","fixed":["2023.05.4"],"affected":"< 2023.05.4","ecosystem":"vendor"},{"name":"JetBrains TeamCity","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ci-cd","exploited","jetbrains","ransomware","runtime","self-hosted","teamcity"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the JetBrains mitigation or upgrade to the fixed TeamCity version per vendor instructions; discontinue use if no mitigation is available (per CISA required action). Affected and fixed version ranges are not stated in the sources.","status":"open","published_at":"2023-09-19T17:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:30+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:04:30Z","model":"claude-haiku-5-5","output":{"fix":"Apply the JetBrains mitigation or upgrade to the fixed TeamCity version per vendor instructions; discontinue use if no mitigation is available (per CISA required action). Affected and fixed version ranges are not stated in the sources.","reach":"internet","impact":"high","summary":"JetBrains TeamCity Server has an authentication bypass that lets an unauthenticated remote attacker run code on the server. CISA lists it as actively exploited in the wild, with ransomware use noted in the sources.","category":"runtime","who_cares":["teamcity","jetbrains","self-hosted","ci-cd"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the TeamCity server","analyst_note":"Find the affected and fixed TeamCity version ranges and the vendor mitigation steps at the JetBrains advisory for CVE-2023-42793, and the exposure check (e.g. a version or endpoint to look for).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2812,"output_tokens":414,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':17A,20A '-42793':18A,21A '2023.05.4':5A 'action':89C 'activ':59B 'allow':79C 'appli':90C 'attack':49B 'authent':6A,42B,75C 'bypass':7A,43B,76C 'cd':28B 'ci':27B 'ci-cd':26B 'cisa':55B,87C 'code':51B,82C 'contain':73C 'cve':16A,19A 'discontinu':96C 'execut':83C 'exploit':29B,60B 'host':35B 'instruct':94C 'jetbrain':2A,30B,37B,71C 'jetbrains':22A,24A 'lead':8A 'let':45B 'list':56B 'mitig':91C,102C 'note':67B 'per':92C 'possibl':15A 'product':100C 'ransomwar':31B,65B 'rce':10A 'remot':48B,81C 'requir':88C 'run':50B 'runtim':32B 'self':34B 'self-host':33B 'server':13A,39B,54B,86C 'sourc':70B 'teamciti':3A,12A,36B,38B,72C,85C 'teamcity':23A,25A 'unauthent':47B 'unavail':104C 'use':66B,97C 'vendor':93C 'vulner':77C 'wild':63B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-19T17:15:08+00:00","kev":{"dateAdded":"2023-10-04","dueDate":"2023-10-25","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-42793","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-42793","severity":null,"published_at":"2023-10-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-42793","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42793","severity":null,"published_at":"2023-09-19T17:15:08+00:00","modified_at":"2026-06-17T06:24:31+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}