Rapid7 throws JetBrains under the bus for 'uncoordinated vulnerability disclosure'

stapp · Mar 5, 2024

Security shop Rapid7 is criticizing JetBrains for flouting its policy against silent patching regarding fixes for two fresh vulnerabilities in the TeamCity CI/CD server.

Rapid7 says it reported the two TeamCity vulnerabilities in mid-February, claiming JetBrains soon after suggested releasing patches for the flaws before publicly disclosing them.
Click to expand...

https://www.theregister.com/2024/03/05/rapid7_jetbrains_vuln_disclosure_dispute/

reasonablePrivacy · Mar 5, 2024

Sad to hear that they are not as friendly to infosec as they are to developers

stapp · Mar 7, 2024

JetBrains TeamCity under attack by ransomware thugs after disclosure mess
More than 1,000 servers remain unpatched and vulnerable
Click to expand...

Security misconfiguration search engine LeakIX also said CVE-2024-27198, the most severe of the two vulnerabilities, was being exploited at a mass scale, with attackers breaking into CI/CD servers and creating hundreds of accounts for later use.
Click to expand...

https://www.theregister.com/2024/03/07/teamcity_exploits_lead_to_ransomware/

Log in or Sign up

Rapid7 throws JetBrains under the bus for 'uncoordinated vulnerability disclosure'

stapp Global Moderator

reasonablePrivacy Registered Member

stapp Global Moderator

Log in or Sign up

Rapid7 throws JetBrains under the bus for 'uncoordinated vulnerability disclosure'

stapp Global Moderator

reasonablePrivacy Registered Member

stapp Global Moderator

Useful Searches