CVE-2024-50703: TeamPass Privileges Issue Leading to Unauthorized Access
Summary
CVE-2024-50703: TeamPass privileges issue. Affects nilsteampassnet/teampass versions < 3.1.3.1. Fixed in 3.1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is an open-source password management tool designed for collaborative environments. It allows users to securely store and manage passwords, sharing them with team members while maintaining control over access rights. The application is built on PHP and utilizes a MySQL database for storage. However, prior to version 3.1.3.1, TeamPass had a critical vulnerability that allowed users to exploit privilege escalation, potentially compromising sensitive information.
Vulnerability Detail
The vulnerability in TeamPass arises from improper handling of user privileges, allowing a user to act with the privileges of a different user_id. This issue can lead to unauthorized access to sensitive data, as users can manipulate the application to gain access to resources they should not be able to view or modify. The root cause of this vulnerability is linked to the application's failure to adequately enforce user permissions, which is classified under CWE-639 (Authorization Issues).
How To Fix
Minimum fixed version
3.1.3.1
This is the first release that contains the fix.
composer require nilsteampassnet/teampass:3.1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user access to sensitive functionalities until the application is updated. Regularly audit user permissions to ensure that no unauthorized access is granted.
Conclusion
The TeamPass privileges issue (CVE-2024-50703) is a critical vulnerability that can lead to unauthorized access to sensitive information. It is crucial for users to update to version 3.1.3.1 or later to mitigate this risk. Implementing temporary workarounds and regularly auditing user permissions can help manage the situation until an update is applied.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
CVE-2024-50703 is a vulnerability in TeamPass that allows users to exploit privileges of other users, potentially leading to unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, implement strict access controls and regularly review user permissions as a temporary measure.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, which may result in data breaches, loss of user trust, and potential legal ramifications.
More information about TeamPass, including its features and documentation, can be found on its official GitHub repository and website.
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
