DOM-Based XSS Vulnerability in JetBrains TeamCity Performance Monitor
CVE-2025-52875

5.4MEDIUM

Key Information:

Vendor

Jetbrains
Status
Teamcity
Vendor
CVE Published:
23 June 2025

What is CVE-2025-52875?

In JetBrains TeamCity prior to version 2025.03.3, a vulnerability allowed for DOM-based Cross-Site Scripting (XSS) in the Performance Monitor page. This weakness could be exploited by users to inject malicious scripts, potentially compromising the integrity of user sessions and leading to unauthorized actions within the application. It's essential for JetBrains TeamCity users to upgrade to the latest version to mitigate this risk.

Affected Version(s)

TeamCity 0 < 2025.03.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52875 : DOM-Based XSS Vulnerability in JetBrains TeamCity Performance Monitor