CVE-2021-43198: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2021.1.2, a stored Cross-Site Scripting (XSS) vulnerability was discovered. The vulnerability was assigned identifier CVE-2021-43198 and was publicly disclosed on November 8, 2021. This security issue affected all versions of TeamCity prior to the patched version (JetBrains Bulletin).

The vulnerability was classified as a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue. According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 5.4 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it was rated at 3.5 (Low severity) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N) (NVD).

The vulnerability could allow an attacker to execute stored cross-site scripting attacks against TeamCity users. This could potentially lead to unauthorized access to sensitive information and manipulation of web content within the application's context (NVD).

The vulnerability was patched in TeamCity version 2021.1.2. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Bulletin).