GHSA-v969-5v7f-pmg2

ghsaUSosv

TeamPass Stored Cross-site Scripting

view advisory published 2022-05-24Licence: CC-BY-4.0

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-17205US	medium6.1	1.03% (64th)	—	2019-10-05
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload wil…

references

External citations — patches, advisories, analysis.

https://github.com/nilsteampassnet/TeamPassPACKAGE
https://github.com/nilsteampassnet/TeamPass/issues/2688WEB
https://github.com/nilsteampassnet/TeamPass/pull/2739/commits/ecdc6ca5a6e8c4b0b15d48f7e6327bf642fa6312WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-17205ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan