Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00aDJxLTg0dzctNG1oeM4AAywf

nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS)

nilsteampassnet/teampass prior to 3.0.3 is vulnerable to stored cross-site scripting (XSS) in the description parameter of a folder.

Permalink: https://github.com/advisories/GHSA-4h2q-84w7-4mhx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00aDJxLTg0dzctNG1oeM4AAywf
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: almost 2 years ago

CVSS Score: 5.8
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

EPSS Percentage: 0.00059
EPSS Percentile: 0.26537

Identifiers: GHSA-4h2q-84w7-4mhx, CVE-2023-2021
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-2021
• https://github.com/nilsteampassnet/teampass/commit/77c541a0151841d1f4ceb0a84ca391e1b526d58d
• https://huntr.dev/bounties/2e31082d-7aeb-46ff-84d6-9561758e3bf0
• https://github.com/advisories/GHSA-4h2q-84w7-4mhx

Repository: https://github.com/nilsteampassnet/teampass
Blast Radius: 3.5

Affected Packages