{"id":"CVE-2022-48428","published":"2023-03-27T15:27:17Z","modified":"2025-02-19T16:05:55Z","title":"In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible","vendor":"JetBrains","product":"TeamCity","tier":"core","eol":null,"affectedVersions":[{"vendor":"JetBrains","product":"TeamCity","versions":["< 2022.10.3"]}],"description":{"text":"In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible","provenance":"source","from":"CVE.org"},"summary":{"text":"A stored cross-site scripting flaw exists in the SSH keys page of JetBrains TeamCity, affecting releases before 2022.10.3. An attacker with low-privilege authenticated access can plant script that executes in the browser of another user who views the page, which requires that user to interact with the malicious content over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:38Z"},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.6796,"percentile":0.9932,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-51124","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51124","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-48428","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9932"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.22,"detail":"base score 4.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}