TeamPass Stored Cross-site Scripting Vulnerability in nilsteampassnet/teampass
Summary
CVE-2019-17203: TeamPass Stored Cross-site Scripting. Affects nilsteampassnet/teampass versions < 2.1.27.36. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nilsteampassnet/teampass is an open-source password manager that allows teams to securely store and share passwords. It provides a web-based interface for managing passwords and supports organizing them into folders. The vulnerability affects version 2.1.27.36 of the package.
Vulnerability Detail
The vulnerability in TeamPass 2.1.27.36 is a stored cross-site scripting (XSS) vulnerability. It can be exploited by setting a crafted password for an item in any folder. When a user performs a search, the crafted password can trigger the XSS vulnerability, allowing an attacker to execute malicious scripts in the context of the user's browser. This can lead to various security risks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to a patched version of TeamPass.
Conclusion
The stored cross-site scripting vulnerability in nilsteampassnet/teampass version 2.1.27.36 can be exploited by setting a crafted password. This can lead to the execution of malicious scripts in the user's browser, potentially resulting in the theft of sensitive information or unauthorized actions. To mitigate this vulnerability, it is crucial to upgrade to a patched version of TeamPass. For further support, you can contact DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser, potentially leading to the theft of sensitive information or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
No, only version 2.1.27.36 of nilsteampassnet/teampass is affected by this vulnerability. It is recommended to upgrade to a patched version.
No, there is no known workaround for this vulnerability. Upgrading to a patched version is the recommended solution.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on fixing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
