CVE-2024-36372

Deeper analysis

CVE-2024-36372 is a reflected cross-site scripting vulnerability (CWE-79) affecting the subscriptions page in JetBrains TeamCity versions prior to 2023.05.6. The flaw carries a CVSS 3.1 score of 4.6 and stems from insufficient input sanitization that allows attacker-controlled content to be reflected back to users in the web interface.

An authenticated attacker with low privileges can craft a malicious link or request that, when clicked by a victim user, executes arbitrary script in the context of the TeamCity application. Successful exploitation yields limited read and write access to application data but requires user interaction and does not impact availability.

JetBrains has addressed the issue in TeamCity 2023.05.6, as documented on its published security fixes page, which lists the resolved reflected-XSS condition on the subscriptions page.

The associated EPSS score has remained steady at 0.2676 with no material increase since disclosure, indicating moderate but stable exploitation interest.