Reflected XSS Vulnerability in JetBrains TeamCity
CVE-2023-38066
4.6MEDIUM
What is CVE-2023-38066?
A vulnerability in JetBrains TeamCity allows for reflected Cross-Site Scripting (XSS) through manipulation of the Referer header during artifact downloads. In versions prior to 2023.05.1, attackers could exploit this weakness to execute harmful scripts in the context of a user's web browser, potentially compromising sensitive data or user sessions.
Affected Version(s)
TeamCity 0 < 2023.05.1
References
EPSS Score
25% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved