PT-2023-10306 · Jetbrains · Teamcity

Published 2023-06-29 · Updated 2023-07-06 · CVE-2015-1313

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions 8 through 9.0.1 JetBrains TeamCity version 9.0.2 is not affected, so only versions prior to 9.0.2 are considered vulnerable.

Description The issue allows bypass of account-creation restrictions via a crafted request. This is possible because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

Recommendations For JetBrains TeamCity versions 8 through 9.0.1, update to version 9.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the account creation functionality until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2015-1313

Affected Products

Teamcity

References · 5

• 🔥 https://beyondbinary.io/articles/teamcity-account-creation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1313 · Security Note
• https://t.me/cibsecurity/65726 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1313 · Note
• https://jetbrains.com/teamcity/download · Note