GHSA-rpmr-fwh5-24fm

ghsaUSosv

TeamPass Cross-site Scripting (XSS) vulnerability

view advisory published 2022-05-24Licence: CC-BY-4.0

TeamPass 2.1.27.36 allows XSS by setting a crafted password for an item in a folder, and then sharing that item with an admin. (The crafted password is exploitable when viewing the change history, or the previous used password field.)

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-16904US	medium5.4	0.69% (53rd)	—	2019-09-26
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable…

references

External citations — patches, advisories, analysis.

https://github.com/nilsteampassnet/TeamPassPACKAGE
https://github.com/nilsteampassnet/TeamPass/issues/2685WEB
https://github.com/nilsteampassnet/TeamPass/issues/2734WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-16904ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan