Cyber Posture

CVE-2025-31141

Low

Published: 27 March 2025

Published
27 March 2025
Modified
16 May 2025
KEV Added
Patch
CVSS Score 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0000 0.1th percentile
Risk Priority 5 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-31141 is a low-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Jetbrains Teamcity. Its CVSS base score is 2.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unsecured Credentials (T1552). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires error handling that prevents disclosure of sensitive credentials in exception messages on the Cloud Profiles page.

prevent

Mandates timely remediation of the specific software flaw in JetBrains TeamCity that causes the credential-leaking exception.

detect

Provides monitoring to detect unauthorized disclosures of credentials resulting from the exception on the Cloud Profiles page.

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Why these techniques?

The vulnerability directly causes credential leakage via error messages on the Cloud Profiles page, facilitating Unsecured Credentials access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page

Deeper analysisAI

CVE-2025-31141 affects JetBrains TeamCity versions before 2025.03, where an exception on the Cloud Profiles page could lead to credential leakage. This vulnerability falls under CWE-209 (Generation of Error Message Containing Sensitive Information) and carries a CVSS v3.1 base score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), indicating low severity primarily due to the high privileges required.

Exploitation requires a high-privileged user (PR:H) with network access to the TeamCity instance, low attack complexity, and no user interaction. Attackers can trigger the exception to disclose sensitive credentials, resulting in low-impact confidentiality loss without affecting integrity or availability.

JetBrains has fixed this issue in TeamCity 2025.03, as documented on their issues fixed page at https://www.jetbrains.com/privacy-security/issues-fixed/. Mitigation involves updating to version 2025.03 or later.

Details

CWE(s)

Affected Products

jetbrains
teamcity
≤ 2025.03

CVEs Like This One

CVE-2025-26492Same product: Jetbrains Teamcity
CVE-2025-24459Same product: Jetbrains Teamcity
CVE-2025-26493Same product: Jetbrains Teamcity
CVE-2025-22218Shared CWE-209
CVE-2024-12380Shared CWE-209
CVE-2026-28193Same vendor: Jetbrains
CVE-2026-41153Same vendor: Jetbrains
CVE-2026-41882Same vendor: Jetbrains
CVE-2025-23385Same vendor: Jetbrains
CVE-2025-24458Same vendor: Jetbrains

References