Threats Tagged 'cve-2025-68165'

CVE-2025-68165 is a reflected Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity versions prior to 2025.11, specifically affecting the VCS Root setup interface. This vulnerability allows an unauthenticated attacker to inject malicious scripts that execute in the context of a victim's browser when they interact with the vulnerable page, requiring user interaction but no privileges. The CVSS score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact without affecting availability. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using TeamCity for continuous integration and deployment may face risks of session hijacking, credential theft, or further exploitation via this vulnerability. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding on VCS Root setup parameters, and restricting access to TeamCity interfaces. Countries with significant software development sectors and high adoption of JetBrains products, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity and the requirement for user interaction, defenders should prioritize monitoring and timely patching to reduce exposure.

MediumVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-68165#cwe-79