CVE-2024-24938: 
JetBrains TeamCity vulnerability analysis and mitigation

A limited directory traversal vulnerability was discovered in JetBrains TeamCity versions before 2023.11.2, specifically affecting the Kotlin DSL documentation functionality. The vulnerability was assigned CVE-2024-24938 and was disclosed on February 6, 2024 (NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal). It received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in low confidentiality impact (NVD).

The vulnerability allows attackers to potentially access files outside of intended directories through the Kotlin DSL documentation feature, leading to unauthorized information disclosure. The CVSS scoring indicates that while the vulnerability can compromise confidentiality, it does not affect system integrity or availability (NVD).

The vulnerability has been patched in TeamCity version 2023.11.2. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).