CVE-2024-36367
Published: 29 May 2024
Summary
CVE-2024-36367 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jetbrains Teamcity. Its CVSS base score is 4.6 (Medium).
Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-36367 is a stored cross-site scripting vulnerability (CWE-79) affecting JetBrains TeamCity versions prior to 2022.04.7, 2022.10.6, 2023.05.6, and 2023.11.5. The flaw allows malicious content to be persisted through third-party reports, which are then rendered in users' browsers when the reports are viewed.
An attacker with low privileges can exploit the issue over the network by submitting crafted third-party reports containing executable scripts. Successful exploitation requires user interaction from a victim who views the report, after which the attacker can achieve limited impacts on confidentiality and integrity within the victim's session context, as reflected in the CVSS 4.6 vector.
The vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ identifies the affected releases and directs administrators to apply the listed fixed versions to eliminate the stored XSS vector.
EPSS remains flat at 0.2676 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36035
Vulnerability details
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.