CVE-2024-56355

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.12

Description The issue exists due to the missing Content-Type header in the RemoteBuildLogController response, which could lead to a cross-site scripting (XSS) attack. This allows a remote attacker to conduct an XSS attack.

Recommendations For versions prior to 2024.12, consider disabling the RemoteBuildLogController or restricting access to it until a patch is available. As a temporary workaround, avoid using the RemoteBuildLogController response in sensitive operations. Update to version 2024.12 or later to resolve the issue.