{"id":"CVE-2023-42793","published":"2023-09-19T17:15:08Z","modified":"2026-06-17T06:24:31Z","title":"JetBrains TeamCity Authentication Bypass Vulnerability","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"description":{"text":"In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass in the TeamCity component of JetBrains' TeamCity product, affecting versions before 2023.05.4. An unauthenticated remote attacker over the network can bypass authentication and achieve remote code execution on the TeamCity Server, with no user interaction or prior credentials required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99987,"percentile":0.99983,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-10-04","dueDate":"2023-10-25","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/ ;  https://nvd.nist.gov/vuln/detail/CVE-2023-42793","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-01","exploitedFirstSeen":"2023-10-01","ransomware":true,"evidence":[{"url":"https://x.com/PRODAFT/status/1708586257444430019","date":"2023-10-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-04"},{"url":"https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/","date":"2023-10-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-18&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2023-42793","date":"2023-11-22"}],"evidenceTotal":942,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793","tags":["Third Party Advisory"]},{"url":"https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/","tags":["Vendor Advisory"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/","tags":["Press/Media Coverage"]},{"url":"https://www.sonarsource.com/blog/teamcity-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793","tags":["Third Party Advisory"]},{"url":"https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/","tags":["Vendor Advisory"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/","tags":["Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files.","confidence":"high"},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-47222","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-47222","exploited":true,"exploitedSince":"2023-10-04","provenance":"source"},"exploits":[{"id":51884,"url":"https://www.exploit-db.com/exploits/51884","title":"JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)","type":"remote","platform":"java","date":"2024-03-14","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2024-03-14"},"pocGithub":{"count":13,"skipped":4,"earliest":"2023-09-29","earliestUrl":"https://github.com/H454NSec/CVE-2023-42793","repos":[{"name":"H454NSec/CVE-2023-42793","url":"https://github.com/H454NSec/CVE-2023-42793","stars":45,"created":"2023-09-29"},{"name":"B4l3rI0n/CVE-2023-42793","url":"https://github.com/B4l3rI0n/CVE-2023-42793","stars":11,"created":"2024-04-24"},{"name":"Zenmovie/CVE-2023-42793","url":"https://github.com/Zenmovie/CVE-2023-42793","stars":9,"created":"2023-10-05"},{"name":"hotplugin0x01/CVE-2023-42793","url":"https://github.com/hotplugin0x01/CVE-2023-42793","stars":2,"created":"2024-04-21"},{"name":"junnythemarksman/CVE-2023-42793","url":"https://github.com/junnythemarksman/CVE-2023-42793","stars":1,"created":"2024-05-27"}]},"metasploit":[{"name":"JetBrains TeamCity Unauthenticated Remote Code Execution","module":"exploit/multi/http/jetbrains_teamcity_rce_cve_2023_42793","type":"exploit","disclosureDate":"2023-09-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2023_42793.rb"}],"nuclei":[{"id":"CVE-2023-42793","name":"JetBrains TeamCity < 2023.05.4 - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-42793.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42793.yaml"}],"first":{"date":"2023-09-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2023_42793.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html","https://www.sonarsource.com/blog/teamcity-vulnerability/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.003"],"provenance":"source"}],"timeline":[{"date":"2023-09-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42793","provenance":"source"},{"date":"2023-09-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-09-29, Exploit-DB 2024-03-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jetbrains_teamcity_rce_cve_2023_42793.rb","provenance":"source"},{"date":"2023-10-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/PRODAFT/status/1708586257444430019","provenance":"source"},{"date":"2023-10-04","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-47222","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":15},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1125 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 13 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}