Stored XSS Vulnerability in JetBrains TeamCity Affecting Custom Builds
CVE-2023-38063

5.4MEDIUM

Key Information:

Vendor

JetBrains
Status
TeamCity
Vendor
CVE Published:
12 July 2023

What is CVE-2023-38063?

A stored Cross-Site Scripting (XSS) vulnerability was identified in JetBrains TeamCity prior to version 2023.05.1. This flaw allows attackers to inject malicious scripts into the application during custom builds, potentially compromising users' data and session information. The impact may vary depending on the permissions set during the build process, posing a risk to the overall integrity of the platform. Users are advised to update to the latest version to mitigate potential threats.

Affected Version(s)

TeamCity 0 < 2023.05.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

EPSS Score

50% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.