Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yY3Y1LXF2cTMtNjI3Ns4AA0f-

TeamPass vulnerable to Improper Encoding or Escaping of Output

TeamPass prior to 3.0.10 is vulnerable to cross-site scripting filter bypass in folder names. This can lead to information disclosure.

Permalink: https://github.com/advisories/GHSA-2cv5-qvq3-6276
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yY3Y1LXF2cTMtNjI3Ns4AA0f-
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 10 months ago
Updated: 6 months ago

CVSS Score: 7.6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Identifiers: GHSA-2cv5-qvq3-6276, CVE-2023-3552
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-3552
• https://github.com/nilsteampassnet/teampass/commit/8acb4dacc2d008a4186a4e13cc143e978f113955
• https://huntr.dev/bounties/aeb2f43f-0602-4ac6-9685-273e87ff4ded
• https://github.com/advisories/GHSA-2cv5-qvq3-6276

Repository: https://github.com/nilsteampassnet/teampass
Blast Radius: 4.6

Affected Packages