Reflected XSS Vulnerability in JetBrains TeamCity Subscriptions Page
CVE-2023-34226

6.1MEDIUM

Key Information:

Vendor

JetBrains
Status
TeamCity
Vendor
CVE Published:
31 May 2023

What is CVE-2023-34226?

A reflected Cross-Site Scripting (XSS) vulnerability exists in JetBrains TeamCity prior to version 2023.05, specifically affecting the Subscriptions page. This vulnerability allows attackers to inject malicious scripts through crafted requests, potentially compromising user sessions and sensitive information. It highlights the importance of securing web interfaces to prevent unauthorized script execution.

Affected Version(s)

TeamCity 0 < 2023.05

References

https://www.jetbrains.com/privacy-security/issues-fixed/

EPSS Score

25% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.