CVE-2024-35301: 
JetBrains TeamCity vulnerability analysis and mitigation

A security vulnerability identified as CVE-2024-35301 was discovered in JetBrains TeamCity versions prior to 2024.03.1. The vulnerability relates to the commit status publisher functionality, which failed to properly verify the project scope of GitHub App tokens (JetBrains Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. The issue is classified under CWE-280 (Improper Handling of Insufficient Permissions or Privileges). The vulnerability affects all versions of JetBrains TeamCity before version 2024.03.1 (NVD Database).

The vulnerability could potentially lead to information disclosure and limited integrity impacts due to improper permission handling in the GitHub App token scope verification process. The CVSS scoring indicates low confidentiality and integrity impacts, with no availability impact (NVD Database).

The vulnerability requires network access and high privileges for exploitation, but has low attack complexity and requires no user interaction, as indicated by the CVSS vector string (NVD Database).

The vulnerability has been patched in JetBrains TeamCity version 2024.03.1. Users are advised to upgrade to this version or later to address the security issue (JetBrains Advisory).