CVE-2024-28174: 
JetBrains TeamCity vulnerability analysis and mitigation

A security vulnerability was identified in JetBrains TeamCity versions prior to 2023.11.4, where presigned URL generation requests in the S3 Artifact Storage plugin were not properly authorized. The vulnerability was assigned CVE-2024-28174 and was reported by the Rapid7 team (NVD, JetBrains Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and received a CVSS v3.1 base score of 5.8 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can potentially impact system integrity (NVD).

The vulnerability could allow unauthorized access to presigned URL generation requests in the S3 Artifact Storage plugin, potentially compromising the integrity of artifact storage operations (NVD).

The vulnerability is remotely exploitable with no authentication required, as indicated by the CVSS metrics showing network accessibility (AV:N) and no privileges required (PR:N) (NVD).

Users are advised to upgrade to TeamCity version 2023.11.4 or later to address this vulnerability (JetBrains Advisory).