CVE-2025-47854: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-47854 is a security vulnerability discovered in JetBrains TeamCity versions before 2025.03.2. The vulnerability was identified as an open redirect issue that could occur on the VCS Root editing page. The vulnerability was disclosed on May 20, 2025, and was assigned by JetBrains s.r.o. as the CNA (CVE Numbering Authority) (NVD, Wiz).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with varying CVSS v3.1 Base Scores. The NVD assessment rates it at 6.1 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while the CNA (JetBrains) assessment gives it a score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The technical characteristics indicate that the vulnerability is network accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability could enable attackers to perform open redirect attacks, potentially leading to phishing attempts where users might be redirected to malicious websites while believing they are interacting with legitimate TeamCity pages (Wiz).

The vulnerability has been addressed and fixed in JetBrains TeamCity version 2025.03.2. Users are strongly recommended to upgrade to this version or later to mitigate the risk (JetBrains Security).