CVE-2022-36322

In TeamCity before 2022.04.2, a user could inject build parameters, a limited integrity-and-confidentiality issue that requires an authenticated account with some privilege to reach. It is not a remote-unauthenticated takeover; it is a lower-privileged user bending the build configuration in ways they shouldn't be able to. The 5.4 reflects that the impact is partial and the door needs a valid login.

That said, CI systems are high-value ground because they hold source, secrets, and deployment reach, so parameter manipulation there is worth taking seriously even at medium severity. The realistic threat model is an insider or a compromised low-tier account rather than a mass-scanning botnet; there is nothing here for opportunistic internet attackers, which caps the exploitation tempo.

We would weigh this by who can log into the given TeamCity instance and how sensitive its pipelines are, rather than by the CVSS alone. A build server that authenticates a broad set of developers and touches production deserves the patch promptly; a locked-down instance with a handful of trusted operators can be scheduled normally. The point is proportionality: the precondition is doing most of the risk-reduction already.