CVE-2022-25261: 
JetBrains TeamCity vulnerability analysis and mitigation

JetBrains TeamCity before version 2021.2.2 was identified with a reflected Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2022-25261. The vulnerability was disclosed on February 25, 2022, affecting the TeamCity continuous integration and deployment server software (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a base score of 4.3 (Medium) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79, which refers to Improper Neutralization of Input During Web Page Generation (NVD).

The reflected XSS vulnerability could potentially allow attackers to execute arbitrary web scripts or HTML in the context of other users' browsers, leading to unauthorized access to sensitive information or performing actions on behalf of the victim (NVD).

The vulnerability was addressed in TeamCity version 2021.2.2. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Security).