CVE-2021-43197: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2021.1.2, a security vulnerability was identified where email notifications could include unescaped HTML, potentially leading to Cross-Site Scripting (XSS) attacks. The vulnerability was discovered and disclosed in November 2021, affecting all versions of TeamCity prior to the patched version (JetBrains Blog).

The vulnerability is classified with a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue specifically relates to the email notification system where HTML content was not properly escaped before being included in email notifications (NVD).

The vulnerability could allow attackers to execute malicious scripts through email notifications, potentially leading to unauthorized access to sensitive information or manipulation of user interface elements. The CVSS scoring indicates that while the vulnerability requires user interaction, it could result in limited confidentiality and integrity impacts across security boundaries (NVD).

The vulnerability was patched in TeamCity version 2021.1.2. Users are advised to upgrade to this version or later to mitigate the risk. No alternative workarounds were published (JetBrains Blog).