Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-18363: TeamCity may expose deleted build history

CVE-2019-18363 · published 7 years ago

Summary

Versions of TeamCity released before 2019.1.2 can allow someone to see the build records of a configuration that has been removed, under certain conditions. This could reveal details about past software builds that should be hidden. Update TeamCity to version 2019.1.2 or newer to close the gap.

What to do

Update jetbrains teamcity to version 2019.1.2 or later.

Affected software

Vendor	Product	Affected versions
jetbrains	teamcity	< 2019.1.2 `cpe:2.3:a:jetbrains:teamcity::::::::`

Original advisory text

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

References

https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/ Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published31 Oct 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-18363 · NVD

Track software like this

Free during beta