CRITICAL9.8

GHSA-q9qr-h33g-fw3j

TeamPass Storing Passwords in a Recoverable Format vulnerability

Details

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/nilsteampassnet/teampass

Introduced in: 0

No fixed version published yet for nilsteampassnet/teampass (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-1000001[ADVISORY]
https://github.com/nilsteampassnet/TeamPass/issues/2495[WEB]
https://github.com/nilsteampassnet/TeamPass[PACKAGE]