Lucene search

[email protected]CVE-2023-38066

HistoryJul 12, 2023 - 1:15 p.m.

CVE-2023-38066

2023-07-1213:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-38066

jetbrains teamcity

reflected xss

referer header

artifact downloads

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.0005 Low

EPSS

Percentile

16.6%

JSON

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads

CPENameOperatorVersion
jetbrains:teamcityjetbrains teamcitylt2023.05.1
jetbrains:teamcityjetbrains teamcityeq2022.04
jetbrains:teamcityjetbrains teamcityeq2018.1.4
jetbrains:teamcityjetbrains teamcityeq8.0.5
jetbrains:teamcityjetbrains teamcityeq2022.04.1
jetbrains:teamcityjetbrains teamcityeq2017.2.4
jetbrains:teamcityjetbrains teamcityeq8.0.1
jetbrains:teamcityjetbrains teamcityeq8.1.4
jetbrains:teamcityjetbrains teamcityeq2018.2.5
jetbrains:teamcityjetbrains teamcityeq7.0

CPE	Name	Operator	Version
jetbrains:teamcity	jetbrains teamcity	lt	2023.05.1
jetbrains:teamcity	jetbrains teamcity	eq	2022.04
jetbrains:teamcity	jetbrains teamcity	eq	2018.1.4
jetbrains:teamcity	jetbrains teamcity	eq	8.0.5
jetbrains:teamcity	jetbrains teamcity	eq	2022.04.1
jetbrains:teamcity	jetbrains teamcity	eq	2017.2.4
jetbrains:teamcity	jetbrains teamcity	eq	8.0.1
jetbrains:teamcity	jetbrains teamcity	eq	8.1.4
jetbrains:teamcity	jetbrains teamcity	eq	2018.2.5
jetbrains:teamcity	jetbrains teamcity	eq	7.0

Rows per page:

1-10 of 1061

References

www.jetbrains.com/privacy-security/issues-fixed/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.0005 Low

EPSS

Percentile

16.6%

JSON

Related for CVE-2023-38066

prion1 cvelist1 nessus1