CVE-2021-31904: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2020.2.2, a cross-site scripting (XSS) vulnerability was discovered on the test history page. The vulnerability was identified and tracked as CVE-2021-31904, and was publicly disclosed on May 11, 2021 (NVD, JetBrains Blog).

The vulnerability was classified as a medium severity issue with a CVSS v3.1 Base Score of 6.1 (MEDIUM). The vulnerability vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it is network exploitable, requires low attack complexity, needs no privileges, requires user interaction, and has a changed scope with low impact on confidentiality and integrity but no impact on availability. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The XSS vulnerability could potentially allow attackers to execute malicious scripts in the context of the user's browser session when viewing the test history page. This could lead to unauthorized access to sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user's session (NVD).

The vulnerability was fixed in TeamCity version 2020.2.2. Users are advised to upgrade to this version or later to mitigate the security risk. No alternative workarounds were published (JetBrains Blog).