TeamPass Stored Cross-site Scripting Vulnerability in nilsteampassnet/teampass
Summary
CVE-2019-17204: TeamPass Stored Cross-site Scripting. Affects nilsteampassnet/teampass versions < 2.1.27.36. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is a password manager designed for collaborative use. It allows users to securely store and share passwords and other sensitive information. The vulnerability affects the nilsteampassnet/teampass package, specifically version 2.1.27.36. This package is part of the Packagist ecosystem and is commonly used in PHP applications.
Vulnerability Detail
The vulnerability in TeamPass 2.1.27.36 is a Stored Cross-site Scripting (XSS) issue. It can be exploited by setting a crafted Knowledge Base label and adding any available item. This allows an attacker to inject malicious scripts or code into the application, which can then be executed in the context of other users accessing the affected knowledge base. The impact of this vulnerability can range from unauthorized access to sensitive information to potential remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the vulnerable knowledge base. This can be done by modifying the application configuration or implementing access controls. However, this is not a permanent solution and should be considered as a temporary measure until the vulnerability is fully patched.
Conclusion
The TeamPass Stored Cross-site Scripting vulnerability in the nilsteampassnet/teampass package can lead to unauthorized access to sensitive information and potential remote code execution. It is crucial for users to update their TeamPass installation to a patched version and regularly update all dependencies to ensure the overall security of their system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
The impact of this vulnerability can range from unauthorized access to sensitive information to potential remote code execution. It allows an attacker to inject malicious scripts or code into the application, which can then be executed in the context of other users accessing the affected knowledge base.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses composer.lock to monitor and alert in real-time for open-source vulnerabilities in the software.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Yes, as a temporary workaround, users can disable the affected functionality or restrict access to the vulnerable knowledge base. However, this is not a permanent solution and should be considered as a temporary measure until the vulnerability is fully patched.
To fix this vulnerability, it is recommended to upgrade to a patched version of TeamPass. The developers of TeamPass have released a fix for this issue in a later version. Users should update their TeamPass installation to a version that is not affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
