CVE-2023-41250: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity versions before 2023.05.3, a reflected Cross-Site Scripting (XSS) vulnerability was discovered during the user registration process. The vulnerability was assigned CVE-2023-41250 and was publicly disclosed on August 25, 2023 (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. However, JetBrains' own assessment rated it lower at 3.5 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (NVD).

The vulnerability could allow attackers to execute malicious scripts in users' browsers during the registration process, potentially leading to data theft or manipulation of the user interface. The CVSS scoring indicates that both confidentiality and integrity impacts are rated as Low, with no impact on availability (NVD).

The vulnerability has been fixed in TeamCity version 2023.05.3. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).