Server-Side XSS Vulnerability in TeamCity Before 2024.07.3
CVE-2024-47951

5.4MEDIUM

Key Information:

Vendor
Jetbrains
Status
Teamcity
Vendor
CVE Published:
8 October 2024

Summary

A stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity allows attackers to inject malicious scripts via server global settings. This could result in unauthorized access and manipulation of user data. Users are advised to update to version 2024.07.3 or later to mitigate this security risk.

Affected Version(s)

TeamCity 0 < 2024.07.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.