CVE-2023-34219: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2023.05, a security vulnerability was discovered where improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API. The vulnerability was assigned CVE-2023-34219 and was disclosed on May 31, 2023 (NVD).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and CWE-285 (Improper Authorization). It received a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, no user interaction, and low impact on integrity (NVD).

The vulnerability allows unauthorized users to modify Build Configuration settings through the REST API, potentially compromising the integrity of build configurations. The impact is primarily limited to the integrity of the system, with no direct effect on confidentiality or availability (NVD).

The vulnerability can be exploited remotely through the REST API interface by users with low-level privileges. No user interaction is required for exploitation, making it relatively straightforward to exploit if an attacker has basic access to the system (NVD).

The vulnerability was fixed in JetBrains TeamCity version 2023.05. Users are advised to upgrade to this version or later to address the security issue (Vendor Advisory).