CVE-2023-38066: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2023.05.1, a reflected Cross-Site Scripting (XSS) vulnerability was discovered that could be exploited via the Referer header during artifact downloads. The vulnerability was assigned CVE-2023-38066 and was disclosed on July 12, 2023 (NVD CVE, MITRE CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the CVSS 3.1 scoring system, it received a base score of 6.1 (Medium) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while JetBrains assessed it with a score of 4.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (NVD CVE).

The vulnerability could allow an attacker to execute cross-site scripting attacks through the Referer header when users download artifacts, potentially leading to unauthorized access to sensitive information or manipulation of web content (NVD CVE).

The vulnerability has been fixed in TeamCity version 2023.05.1. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).