CVE-2023-34226: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2023.05, a reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Subscriptions page. This security issue was assigned CVE-2023-34226 and was disclosed on May 31, 2023 (NVD Database, JetBrains Advisory).

The vulnerability is classified as a CWE-79 type (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-site Scripting. The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability is network accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD Database).

The vulnerability could allow attackers to execute malicious scripts in the context of the user's browser session when accessing the Subscriptions page. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD Database).

The vulnerability has been fixed in JetBrains TeamCity version 2023.05. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).