Medium severity · published Oct 2, 2019
CVE-2019-12156
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource…
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UP
Upsource · Jetbrains
before 2018.2.1290 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12156
Vendor Advisory
https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
More from Upsource
9.8
CVE-2019-12157
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands
7.5
CVE-2021-30482
In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
7.5
CVE-2019-19704
In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm
6.1
CVE-2019-14961
JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS