{"id":"CVE-2023-34220","published":"2023-05-31T13:03:13Z","modified":"2025-01-09T20:03:26Z","title":"In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"affectedVersions":[{"vendor":"JetBrains","product":"TeamCity","versions":["< 2023.05"]}],"description":{"text":"In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible","provenance":"source","from":"CVE.org"},"summary":{"text":"A stored cross-site scripting flaw in the Commit Status Publisher window of JetBrains TeamCity, affecting releases before 2023.05. An attacker with low-privilege authenticated access can plant script that executes in another user's browser when they interact with the affected window, requiring that user to take action, with the result being limited confidentiality and integrity impact and no availability impact over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:37Z"},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.61433,"percentile":0.99162,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-38317","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-38317","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-05-31","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-34220","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9916"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.22,"detail":"base score 4.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}