{"id":"CVE-2024-27198","aliases":["EUVD-2024-24437","GHSA-xh94-49wq-7h2h"],"status":"published","title":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions...","description":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.99938,"percentile":0.99971,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2024-03-04T17:21:39Z","modified":"2026-06-17T07:19:24Z","kev":{"date_added":"2024-03-07","due_date":"2024-03-28","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-03-07"},{"source":"kev","since":"2024-03-07"}],"exploits":[{"source":"pocgithub","id":"Chocapikk/CVE-2024-27198","title":"Chocapikk/CVE-2024-27198","date":"2024-03-04","url":"https://github.com/Chocapikk/CVE-2024-27198"},{"source":"metasploit","id":"exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198","title":"JetBrains TeamCity Unauthenticated Remote Code Execution","type":"exploit","platform":"Java,Linux,Unix,Windows","date":"2024-03-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198"},{"source":"pocgithub","id":"yoryio/CVE-2024-27198","title":"yoryio/CVE-2024-27198","date":"2024-03-05","url":"https://github.com/yoryio/CVE-2024-27198"},{"source":"pocgithub","id":"W01fh4cker/CVE-2024-27198-RCE","title":"W01fh4cker/CVE-2024-27198-RCE","date":"2024-03-06","url":"https://github.com/W01fh4cker/CVE-2024-27198-RCE"},{"source":"pocgithub","id":"rampantspark/CVE-2024-27198","title":"rampantspark/CVE-2024-27198","date":"2024-03-07","url":"https://github.com/rampantspark/CVE-2024-27198"},{"source":"pocgithub","id":"passwa11/CVE-2024-27198-RCE","title":"passwa11/CVE-2024-27198-RCE","date":"2024-03-08","url":"https://github.com/passwa11/CVE-2024-27198-RCE"},{"source":"pocgithub","id":"CharonDefalt/CVE-2024-27198-RCE","title":"CharonDefalt/CVE-2024-27198-RCE","date":"2024-03-09","url":"https://github.com/CharonDefalt/CVE-2024-27198-RCE"},{"source":"pocgithub","id":"Shimon03/Explora-o-RCE-n-o-autenticado-JetBrains-TeamCity-CVE-2024-27198-","title":"Shimon03/Explora-o-RCE-n-o-autenticado-JetBrains-TeamCity-CVE-2024-27198-","date":"2024-04-02","url":"https://github.com/Shimon03/Explora-o-RCE-n-o-autenticado-JetBrains-TeamCity-CVE-2024-27198-"},{"source":"pocgithub","id":"Stuub/RCity-CVE-2024-27198","title":"Stuub/RCity-CVE-2024-27198","date":"2024-04-22","url":"https://github.com/Stuub/RCity-CVE-2024-27198"},{"source":"pocgithub","id":"HPT-Intern-Task-Submission/CVE-2024-27198","title":"HPT-Intern-Task-Submission/CVE-2024-27198","date":"2024-07-20","url":"https://github.com/HPT-Intern-Task-Submission/CVE-2024-27198"},{"source":"pocgithub","id":"jrbH4CK/CVE-2024-27198","title":"jrbH4CK/CVE-2024-27198","date":"2024-08-16","url":"https://github.com/jrbH4CK/CVE-2024-27198"},{"source":"pocgithub","id":"geniuszly/CVE-2024-27198","title":"geniuszly/CVE-2024-27198","date":"2024-10-09","url":"https://github.com/geniuszly/CVE-2024-27198"},{"source":"pocgithub","id":"Cythonic1/CVE-2024-27198_POC","title":"Cythonic1/CVE-2024-27198_POC","date":"2024-10-14","url":"https://github.com/Cythonic1/CVE-2024-27198_POC"},{"source":"pocgithub","id":"ArtemCyberLab/Project-Exploiting-CVE-2024-27198-RCE-Vulnerability","title":"ArtemCyberLab/Project-Exploiting-CVE-2024-27198-RCE-Vulnerability","date":"2025-01-22","url":"https://github.com/ArtemCyberLab/Project-Exploiting-CVE-2024-27198-RCE-Vulnerability"},{"source":"exploitdb","id":"EDB-52411","title":"JetBrains TeamCity 2023.11.4 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2025-08-11","url":"https://www.exploit-db.com/exploits/52411"},{"source":"pocgithub","id":"EynaExp/CVE-2024-27198-POC","title":"EynaExp/CVE-2024-27198-POC","date":"2025-12-17","url":"https://github.com/EynaExp/CVE-2024-27198-POC"},{"source":"pocgithub","id":"Ne0zer01/CVE-2024-27198_LAB","title":"Ne0zer01/CVE-2024-27198_LAB","date":"2026-05-18","url":"https://github.com/Ne0zer01/CVE-2024-27198_LAB"},{"source":"pocgithub","id":"ptd200110/CVE-2024-27198-SOC-Lab","title":"ptd200110/CVE-2024-27198-SOC-Lab","date":"2026-06-19","url":"https://github.com/ptd200110/CVE-2024-27198-SOC-Lab"},{"source":"pocgithub","id":"kxom9ks/CVE-2024-27198-TeamCity","title":"kxom9ks/CVE-2024-27198-TeamCity","date":"2026-07-24","url":"https://github.com/kxom9ks/CVE-2024-27198-TeamCity"},{"source":"pocgithub","id":"GREATKID05/CVE-2024-27198-Assignment","title":"GREATKID05/CVE-2024-27198-Assignment","date":"2026-10-19","url":"https://github.com/GREATKID05/CVE-2024-27198-Assignment"},{"source":"pocgithub","id":"wonnnggge/CVE-2024-27198_CTF","title":"wonnnggge/CVE-2024-27198_CTF","date":"2026-10-19","url":"https://github.com/wonnnggge/CVE-2024-27198_CTF"},{"source":"nuclei","id":"CVE-2024-27198","title":"TeamCity \u003c 2023.11.4 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27198.yaml"}],"products":[{"vendor":"jetbrains","product":"teamcity"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive","tags":["x_transferred","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27198"},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed"},{"url":"https://github.com/advisories/GHSA-xh94-49wq-7h2h"}],"sources":{"cve":[{"id":"CVE-2024-27198","description":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","status":"published","published":"2024-03-04T17:21:39.422Z","modified":"2025-10-21T23:05:23.577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-24437","description":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","status":"published","published":"2024-03-04T17:21:39Z","modified":"2025-10-21T23:05:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-03-07","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-xh94-49wq-7h2h","title":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions...","description":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","status":"published","published":"2024-03-04T18:30:39Z","modified":"2026-03-18T05:06:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:06:41.030615Z"}],"kev":[{"id":"CVE-2024-27198","title":"JetBrains TeamCity Authentication Bypass Vulnerability","description":"JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.","cwes":["CWE-288"],"kev":{"date_added":"2024-03-07","due_date":"2024-03-28","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-27198","description":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","status":"published","published":"2024-03-04T18:15:09.04Z","modified":"2026-06-17T07:19:24.987Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:09:39.488031Z"}]}}