CVE-2023-50870: 
JetBrains TeamCity vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in JetBrains TeamCity versions prior to 2023.11.1. The vulnerability was discovered and disclosed on December 15, 2023, affecting the login functionality of the TeamCity application (NVD Database).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). According to the CVSS 3.1 scoring system, there are two different severity assessments: NIST rates it as HIGH with a base score of 8.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while JetBrains rates it as MEDIUM with a base score of 4.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) (NVD Database).

The vulnerability could potentially allow attackers to execute unauthorized actions on behalf of authenticated users during the login process. The varying CVSS scores indicate different assessments of the potential impact, with NIST suggesting high potential for confidentiality, integrity, and availability breaches, while JetBrains assessment indicates lower severity with only confidentiality concerns (NVD Database).

The vulnerability has been patched in TeamCity version 2023.11.1. Users are advised to upgrade to this version or newer to mitigate the CSRF vulnerability (JetBrains Advisory).