CVE-2025-52877: 
JetBrains TeamCity vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in JetBrains TeamCity before version 2025.03.3, specifically affecting the diskUsageBuildsStats page. The vulnerability was assigned identifier CVE-2025-52877 and was disclosed on June 23, 2025 (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the CVSS 3.1 scoring system, it received a base score of 4.8 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires high privileges and user interaction to exploit, with potential impact on confidentiality and integrity but no impact on availability (NVD, Wiz).

The vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser session when accessing the diskUsageBuildsStats page. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (Wiz).

The vulnerability has been fixed in JetBrains TeamCity version 2025.03.3. Users are advised to upgrade to this version or later to mitigate the risk (Vendor Advisory).