CVE-2015-1313

JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

Affected

JetBrains · TeamCity

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2023-06-29

Updated

2024-11-26

Proof-of-concept exploits (1)

• https://beyondbinary.io/articles/teamcity-account-creation/

Security advisories

• https://beyondbinary.io/articles/teamcity-account-creation
• https://www.jetbrains.com/teamcity/download

References

• CVE Record
• NVD entry