CVE-2024-24937: 
JetBrains TeamCity vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in JetBrains TeamCity versions prior to 2023.11.2. The vulnerability was identified and tracked as CVE-2024-24937, which specifically involved agent distribution functionality (NVD CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NIST NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. JetBrains' own assessment rated it slightly lower at 4.6 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (NVD CVE).

The vulnerability allows for stored XSS attacks through the agent distribution system, potentially leading to unauthorized access to sensitive information and the ability to perform actions on behalf of other users when they access the affected pages (NVD CVE).

The vulnerability has been patched in TeamCity version 2023.11.2. Users are advised to upgrade to this version or later to mitigate the risk (JetBrains Advisory).