In JetBrains TeamCity before version 2025.07.1, an SMTP injection vulnerability was present, allowing attackers to modify email content. This could lead to unauthorized changes in communications sent through the application. The vulnerability is classified as medium severity due to its potential impact on integrity and confidentiality.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2025-57733 |
Exploitation
To exploit this vulnerability, an attacker would need to have high privileges within the JetBrains TeamCity environment. By sending specially crafted SMTP requests, the attacker could manipulate the email content, potentially leading to misinformation or unauthorized actions being communicated to users.
Affected Products
- JetBrains TeamCity: A continuous integration and deployment server that allows teams to automate the build, test, and deployment processes.
Mitigation
To mitigate this vulnerability, users should upgrade to JetBrains TeamCity version 2025.07.1 or later, where the issue has been addressed. Additionally, reviewing and tightening email configurations and permissions can help reduce the risk of exploitation.