CVE-2024-35302

Deeper analysis

CVE-2024-35302 is a stored cross-site scripting vulnerability (CWE-79) that affected JetBrains TeamCity versions prior to 2023.11. The flaw resided in the backup restore process, allowing attacker-controlled content to be stored and later rendered in users' browsers when the restore operation was performed.

An unauthenticated remote attacker could supply a malicious backup archive that, upon restoration, executes arbitrary script in the context of a TeamCity user who views the restored data. The CVSS 5.4 rating reflects network attack vector, low complexity, no required privileges, and required user interaction, resulting in limited impacts to confidentiality and integrity without affecting availability.

JetBrains addressed the issue in the 2023.11 release; the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ recommends upgrading affected installations to that version or later to eliminate the stored XSS vector.

The associated EPSS score rose sharply from a low baseline to a peak of 0.5359 on 2026-05-20 before receding to the current value of 0.0016, indicating a period of elevated exploitation interest after disclosure.