CVE-2021-31908: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2020.2.3, stored XSS (Cross-Site Scripting) vulnerabilities were discovered on several pages of the application (JetBrains Blog, NVD). The vulnerability was assigned identifier CVE-2021-31908 and was disclosed on May 11, 2021.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (Medium severity). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impacts (C:L, I:L) and no availability impact (A:N) (NVD).

The stored XSS vulnerability could allow attackers to inject malicious web scripts or HTML that would be executed in the context of other users' browsers when they visit the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability was fixed in TeamCity version 2020.2.3. Users are advised to upgrade to this version or later to address the security issue (JetBrains Blog).