CVE-2024-31138: JetBrains TeamCity stored XSS via Agent Distribution settings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityRequires authentication and user interaction, but the scope change and high EPSS percentile raise the risk of session compromise in TeamCity environments.

What it is

JetBrains TeamCity before 2024.03 is vulnerable to cross-site scripting through the Agent Distribution settings. An authenticated user with low privileges can inject script that executes in the context of other users who view the affected settings. Because the vulnerable component is a build management server, successful exploitation can compromise sessions of users with broader access.

Impact

An attacker can execute arbitrary script in a victim's browser session, potentially stealing session tokens or performing actions as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component to other TeamCity users.

Attack surface

Reached over the network through the TeamCity web interface; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated attacker must place the payload and a victim must view the affected Agent Distribution settings.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS is high at 0.745 (99.5th percentile), suggesting elevated likelihood of exploitation activity, but the record does not confirm active exploitation.

What to do

• Upgrade TeamCity to 2024.03 or later, which contains the fix.
• Restrict access to Agent Distribution settings to trusted administrators only.
• Enforce least privilege so low-privileged accounts cannot modify agent distribution configuration.
• Apply output encoding and input validation on any custom settings pages if upgrading is delayed.
• Monitor TeamCity audit logs for unexpected changes to agent distribution settings.

Detection

• Review TeamCity audit logs for modifications to Agent Distribution settings by unexpected accounts.
• Search web server and proxy logs for script payloads in requests to agent distribution configuration endpoints.
• Monitor for anomalous authenticated sessions or token reuse following visits to agent settings pages.
• Alert on new or modified agent distribution entries containing HTML or script tags.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.