CVE-2021-25773: 
JetBrains TeamCity vulnerability analysis and mitigation

JetBrains TeamCity before version 2020.2 was identified with a reflected Cross-Site Scripting (XSS) vulnerability affecting several pages (CVE-2021-25773). The vulnerability was discovered and disclosed in February 2021 (JetBrains Blog, NVD).

The vulnerability was classified as a medium severity issue with a CVSS v3.1 Base Score of 6.1 (MEDIUM). The vulnerability vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability was categorized under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The reflected XSS vulnerability could allow attackers to execute arbitrary web script or HTML in the context of the affected TeamCity pages. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user's session (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS vector. No public exploits were reported in the wild at the time of disclosure (NVD).

The vulnerability was patched in TeamCity version 2020.2. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Blog).