CVE-2024-41825: 
JetBrains TeamCity vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in JetBrains TeamCity versions prior to 2024.07, specifically affecting the Code Inspection tab. The vulnerability was disclosed on July 22, 2024, and was assigned the identifier CVE-2024-41825 (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received two different CVSS v3.1 severity ratings. JetBrains assigned it a CVSS score of 4.6 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, while NIST rated it at 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The stored XSS vulnerability could allow attackers to execute malicious scripts in the context of other users' browsers when they visit the affected Code Inspection tab. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability has been fixed in JetBrains TeamCity version 2024.07. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).