CVE-2015-1313

JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://beyondbinary.io/articles/teamcity-account-creation/	Exploit Third Party Advisory
https://www.jetbrains.com/teamcity/download/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-06-29 15:15

Updated : 2023-07-06 18:25

NVD link : CVE-2015-1313

Mitre link : CVE-2015-1313

CVE.ORG link : CVE-2015-1313

JSON object : View

Products Affected

jetbrains

teamcity

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2015-1313", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2023-06-29T15:15:09.190", "references": [{"url": "https://beyondbinary.io/articles/teamcity-account-creation/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.jetbrains.com/teamcity/download/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request."}], "lastModified": "2023-07-06T18:25:35.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B478C03E-46A7-4343-A8AF-D0C01637C0CD", "versionEndExcluding": "9.0.2", "versionStartIncluding": "8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.5 /10