Medium severity · published Jun 29, 2023
CVE-2015-1313
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and…
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
TeamCity · JetBrains
8.0 before 9.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1313
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1313
Exploit
https://beyondbinary.io/articles/teamcity-account-creation/
Product
https://www.jetbrains.com/teamcity/download/
More from TeamCity
9.8
CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
9.8
CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability
9.8
CVE-2023-42793
JetBrains TeamCity Authentication Bypass Vulnerability
7.3
CVE-2024-27199
JetBrains TeamCity Relative Path Traversal Vulnerability
10.0
CVE-2026-106218
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible