GHSA-m2wv-m5pf-284r

ghsaUSosv

Cross-site Scripting in teampass

view advisory published 2022-03-29Licence: CC-BY-4.0

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-26980US	medium6.1	1.09% (65th)	—	2022-03-28
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.

references

External citations — patches, advisories, analysis.

https://gist.github.com/RNPG/6919286e0daebce7634d0a744e060dcaWEB
https://github.com/nilsteampassnet/TeamPass/commits/teampass_2WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-26980ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan