In JetBrains TeamCity before 2025.07.1, an sMTP injection vulnerability was discovered, allowing attackers to modify email content. This could lead to unauthorized information disclosure or manipulation of communications. The vulnerability is classified as medium severity due to its potential impact on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2025-57733 |
Exploitation
To exploit this vulnerability, an attacker would need to have high privileges within the JetBrains TeamCity environment. By leveraging the sMTP injection flaw, the attacker could craft malicious email content that could be sent to users, potentially leading to further exploitation or information disclosure.
Affected Products
- JetBrains TeamCity: A continuous integration and deployment server that allows teams to automate their build, test, and release processes.
Mitigation
To mitigate this vulnerability, users should upgrade to JetBrains TeamCity version 2025.07.1 or later, where the issue has been addressed. Additionally, reviewing email configurations and implementing strict access controls can help reduce the risk of exploitation.