CVE-2025-52876: 
JetBrains TeamCity vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in JetBrains TeamCity versions prior to 2025.03.3, specifically affecting the favoriteIcon page. The vulnerability was disclosed on June 23, 2025, and was assigned the identifier CVE-2025-52876 (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the CVSS v3.1 scoring system, it has received a base score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with the scope being changed and both confidentiality and integrity impacts rated as low (Wiz).

The vulnerability could allow an attacker to execute malicious scripts in a user's browser session within the context of the TeamCity application. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS scoring indicates low impact on both confidentiality and integrity, with no impact on availability (Wiz).

The vulnerability has been fixed in JetBrains TeamCity version 2025.03.3. Users are advised to upgrade to this version or later to mitigate the risk (Vendor Advisory).