Medium severity · published Sep 5, 2019
CVE-2019-15848
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of…
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
TeamCity · JetBrains
2019.1; 2019.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15848
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15848
Patch
https://blog.jetbrains.com/teamcity/2019/09/important-security-notice-xss-vulnerability-allowing-rce/
gist.github.com
https://gist.github.com/JLLeitschuh/fe6784391254b58de680bbda78a04a70
twitter.com
https://twitter.com/JLLeitschuh/status/1169332316612644864?s=20
www.softwaresecured.com
https://www.softwaresecured.com/jetbrains-teamcity-reflected-xss/
More from TeamCity
9.8
CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
9.8
CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability
9.8
CVE-2023-42793
JetBrains TeamCity Authentication Bypass Vulnerability
7.3
CVE-2024-27199
JetBrains TeamCity Relative Path Traversal Vulnerability
10.0
CVE-2026-106218
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible