TeamPass Cross-site Scripting (XSS) Vulnerability in nilsteampassnet/teampass
Summary
CVE-2019-12950: TeamPass Cross-site Scripting (XSS). Affects nilsteampassnet/teampass versions < 2.1.27.35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is an open-source password manager that allows teams to securely store and share passwords. It provides features such as user management, role-based access control, and encryption. The vulnerability affects version 2.1.27.35 of the nilsteampassnet/teampass package. This package is available on Packagist, a popular package repository for PHP applications.
Vulnerability Detail
The vulnerability in TeamPass 2.1.27.35 is a Cross-site Scripting (XSS) issue. It can be exploited through the 'Import items' feature in the sources/items.queries.php file. An attacker can upload a specially crafted CSV file containing an XSS payload. When this file is processed, the payload gets executed in the context of the user's browser, potentially allowing the attacker to steal sensitive information or perform malicious actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by the package maintainers.
Conclusion
The Cross-site Scripting (XSS) vulnerability in TeamPass 2.1.27.35 can be exploited by uploading a specially crafted CSV file. To mitigate the risk, it is recommended to upgrade to a patched version of the nilsteampassnet/teampass package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate web content, or perform other malicious actions.
An attacker can exploit this vulnerability by uploading a specially crafted CSV file containing an XSS payload. When the file is processed by TeamPass, the payload gets executed in the user's browser, potentially allowing the attacker to perform malicious actions.
Yes, the maintainers of TeamPass have released a fix for this vulnerability in a later version of the nilsteampassnet/teampass package. It is recommended to upgrade to the patched version to mitigate the risk.
No, only version 2.1.27.35 of the nilsteampassnet/teampass package is affected by this vulnerability. It is recommended to check the version of the package used in your application and upgrade if necessary.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file of your application.
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
