CVE-2022-48344: 
JetBrains TeamCity vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in JetBrains TeamCity versions prior to 2022.10.2, specifically affecting the group creation process. The vulnerability was assigned identifier CVE-2022-48344 and was publicly disclosed on February 23, 2023 (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-site Scripting. It received a CVSS v3.1 base score of 6.1 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while JetBrains assessed it with a slightly lower score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (NVD).

The vulnerability could potentially allow attackers to execute malicious scripts in the context of the user's browser during the group creation process, potentially leading to unauthorized access to sensitive information and manipulation of web content (NVD).

The vulnerability has been patched in TeamCity version 2022.10.2. Users are advised to upgrade to this version or later to mitigate the security risk (Vendor Advisory).