GHSA-prj5-2g2p-x2mw

    Dashboard / Vulnerabilities / GHSA-prj5-2g2p-x2mw

    GHSA-prj5-2g2p-x2mw

    Published: 9 May 2023Last Modified: 16 Feb 2024
    Aliases:
    CVE-2023-2591

    Summary: teampass vulnerable to code injection

    Details: In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. The issue is fixed in version 3.0.7.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-2591, https://github.com/nilsteampassnet/teampass/commit/57a977c6323656e5dc06ab5c227e75c3465a1a4a, https://github.com/nilsteampassnet/TeamPass, https://huntr.dev/bounties/705f79f4-f5e3-41d7-82a5-f00441cd984b

    Affected packages

    Package

    Name: nilsteampassnet/teampass

    Purl: pkg:composer/nilsteampassnet/teampass

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.0.7

    Affected versions

    2.1.21
    2.1.26
    2.1.27

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-prj5-2g2p-x2mw | CVE-DB