CVE-2015-7562: TeamPass Cross-site Scripting Vulnerability
Summary
CVE-2015-7562: TeamPass vulnerable to Cross-site Scripting. Affects nilsteampassnet/teampass versions < 2.1.25. Fixed in 2.1.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is an open-source password management tool designed for teams to securely share and manage passwords. It provides features such as role-based access control, password generation, and secure storage. However, versions 2.1.24 and earlier are vulnerable to multiple cross-site scripting (XSS) attacks, which can compromise the security of the application and its users.
Vulnerability Detail
The vulnerability arises from inadequate input validation in TeamPass, allowing remote attackers to inject arbitrary web scripts or HTML through the label value of an item or the name of a role. This can lead to unauthorized actions being executed in the context of the user's session, potentially exposing sensitive information or enabling further attacks.
How To Fix
Minimum fixed version
2.1.25
This is the first release that contains the fix.
composer require nilsteampassnet/teampass:2.1.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input sanitization on the affected fields to prevent the execution of malicious scripts. However, this is not a substitute for updating to the patched version.
Conclusion
In summary, TeamPass versions 2.1.24 and earlier are vulnerable to cross-site scripting attacks, which can have serious security implications. It is crucial to update to version 2.1.25 or later to protect against these vulnerabilities. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to execute scripts in the context of a user's session, potentially leading to data theft or unauthorized actions.
Yes, you can implement input sanitization on the affected fields as a temporary measure to reduce the risk of exploitation.
You can find more information on the official TeamPass GitHub repository and security advisories related to the project.
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
