GHSA-h5g9-2p35-54c7

ghsaUSosv

nilsteampassnet/teampass vulnerable to cross-site scripting

view advisory published 2023-05-31Licence: CC-BY-4.0

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. This enables an attacker to inject malicious code into a shared folder, which can then be executed by other users who have access to the folder.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3009US	medium5.4	0.68% (52nd)	Exploit	2023-05-31
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

references

External citations — patches, advisories, analysis.

https://github.com/nilsteampassnet/TeamPassPACKAGE
https://github.com/nilsteampassnet/teampass/commit/6ba8cf1f4b89d62a08d122d533ccf4cb4e26a4eeWEB
https://huntr.dev/bounties/2929faca-5822-4636-8f04-ca5e0001361fWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3009ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan