Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12OTY5LTV2N2YtcG1nMs4AAiRu

TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.

Permalink: https://github.com/advisories/GHSA-v969-5v7f-pmg2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OTY5LTV2N2YtcG1nMs4AAiRu
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 11 days ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-v969-5v7f-pmg2, CVE-2019-17205
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-17205
• https://github.com/nilsteampassnet/TeamPass/issues/2688
• https://github.com/nilsteampassnet/TeamPass/pull/2739/commits/ecdc6ca5a6e8c4b0b15d48f7e6327bf642fa6312
• https://github.com/advisories/GHSA-v969-5v7f-pmg2

Repository: https://github.com/nilsteampassnet/TeamPass
Blast Radius: 3.7

Affected Packages