CVE-2022-48342: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2022.10.2, a security vulnerability was identified where jVMTI (Java Virtual Machine Tool Interface) was enabled by default on agents. This vulnerability was assigned CVE-2022-48342 and was disclosed on February 23, 2023. The issue affects TeamCity installations prior to version 2022.10.2 (JetBrains Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed. However, JetBrains assessed it with a lower CVSS score of 5.2 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-1188 (Insecure Default Initialization of Resource) (NVD).

Based on the CVSS scoring, the vulnerability could potentially lead to high impacts on confidentiality, integrity, and availability of the affected systems according to NIST's assessment. The local attack vector noted in JetBrains' assessment suggests more limited potential impact, with low confidentiality and integrity impacts, and no availability impact (NVD).

The vulnerability has been fixed in TeamCity version 2022.10.2. Organizations running affected versions should upgrade to this version or newer to address the security issue (JetBrains Advisory).