CVE-2024-31137: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity versions before 2024.03, a reflected Cross-Site Scripting (XSS) vulnerability was discovered that could be exploited via Space connection configuration (NVD CVE, JetBrains Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received multiple CVSS v3.1 scores. The NVD assigned a CVSS Base Score of 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while JetBrains assessed it with a CVSS Base Score of 6.8 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N (NVD CVE).

The vulnerability could allow an attacker to execute cross-site scripting attacks through the Space connection configuration interface, potentially leading to unauthorized access to sensitive information and manipulation of user sessions (NVD CVE).

The vulnerability requires user interaction and network access to exploit. The differing CVSS scores between NVD and JetBrains indicate some disagreement about the attack complexity and potential impact, though both agree it requires no privileges to exploit (NVD CVE).

Users are advised to upgrade to TeamCity version 2024.03 or later to address this vulnerability (JetBrains Advisory).