CVE-2024-24936: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2024-24936 affects JetBrains TeamCity versions before 2023.11.2, where access control at the S3 Artifact Storage plugin endpoint was missing. The vulnerability was discovered and disclosed in February 2024, with JetBrains issuing a fix in version 2023.11.2 (JetBrains Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (Medium) according to NIST's assessment, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. JetBrains' own assessment rated it slightly lower at 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is categorized under CWE-285 (Improper Authorization) (NVD).

The vulnerability could potentially allow unauthorized access to the S3 Artifact Storage plugin endpoint in TeamCity installations. Based on the CVSS scores, the primary impact is related to information disclosure with limited severity (NVD).

The vulnerability is network accessible (AV:N) and requires low attack complexity (AC:L). According to NIST's assessment, no privileges are required to exploit this vulnerability, while JetBrains indicates that low privileges are needed (NVD).

The recommended mitigation is to upgrade JetBrains TeamCity to version 2023.11.2 or later, which contains the fix for this vulnerability (JetBrains Advisory).