CVE-2025-31141
Published: 27 March 2025
Summary
CVE-2025-31141 is a low-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Jetbrains Teamcity. Its CVSS base score is 2.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires error handling that prevents disclosure of sensitive credentials in exception messages on the Cloud Profiles page.
Mandates timely remediation of the specific software flaw in JetBrains TeamCity that causes the credential-leaking exception.
Provides monitoring to detect unauthorized disclosures of credentials resulting from the exception on the Cloud Profiles page.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly causes credential leakage via error messages on the Cloud Profiles page, facilitating Unsecured Credentials access.
NVD Description
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
Deeper analysisAI
CVE-2025-31141 affects JetBrains TeamCity versions before 2025.03, where an exception on the Cloud Profiles page could lead to credential leakage. This vulnerability falls under CWE-209 (Generation of Error Message Containing Sensitive Information) and carries a CVSS v3.1 base score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), indicating low severity primarily due to the high privileges required.
Exploitation requires a high-privileged user (PR:H) with network access to the TeamCity instance, low attack complexity, and no user interaction. Attackers can trigger the exception to disclose sensitive credentials, resulting in low-impact confidentiality loss without affecting integrity or availability.
JetBrains has fixed this issue in TeamCity 2025.03, as documented on their issues fixed page at https://www.jetbrains.com/privacy-security/issues-fixed/. Mitigation involves updating to version 2025.03 or later.
Details
- CWE(s)