GHSA-fv48-hjhp-94c7

ghsaUSosv

Incorrect Authorization in TeamPass

view advisory published 2021-07-26Licence: CC-BY-4.0

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-12477US	high7.5OT elevated	1.80% (78th)	—	2020-04-29
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getI…

references

External citations — patches, advisories, analysis.

https://github.com/nilsteampassnet/TeamPass/issues/2761WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-12477ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan