CVE-2024-36369

Deeper analysis

CVE-2024-36369 is a stored cross-site scripting vulnerability (CWE-79) affecting JetBrains TeamCity versions prior to 2022.04.7, 2022.10.6, 2023.05.6, and 2023.11.5. The flaw resides in the product's issue tracker integration component and carries a CVSS 3.1 base score of 4.6, reflecting network attack vector, low attack complexity, and low privileges required.

An authenticated attacker with low privileges can supply malicious content through the issue tracker integration, causing the payload to be stored and later executed in the browsers of other users who view the affected data. Successful exploitation yields limited impacts on confidentiality and integrity while requiring user interaction to trigger.

JetBrains has addressed the issue in the versions listed above, as noted in the vendor's security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Organizations should apply the corresponding updates to eliminate the stored XSS vector.

The associated EPSS score has reached a peak of 0.6082 with a current value of 0.5624, indicating sustained exploitation interest following disclosure.