CVE-2015-1313

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
JetBrains	TeamCity	>= 8.0.1, < 9.0.2

References

https://beyondbinary.io/articles/teamcity-account-creation/Exploit, Third Party Advisory
https://www.jetbrains.com/teamcity/download/Product
https://beyondbinary.io/articles/teamcity-account-creation/Exploit, Third Party Advisory
https://www.jetbrains.com/teamcity/download/Product

Timeline

Published: Jun 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-13142.1The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, wh CVE-2015-13157.5Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code v CVE-2015-13167.5Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.CVE-2015-13177.5Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or po CVE-2015-13187.2The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport CVE-2015-13192.1The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly dete CVE-2015-13209.8The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects CVE-2015-13216.8Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (c CVE-2015-13224.6Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before CVE-2015-13235.5The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged CVE-2015-13247.8Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 CVE-2015-13257.0Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2