MEDIUM6.1

GHSA-v969-5v7f-pmg2

TeamPass Stored Cross-site Scripting

Details

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/nilsteampassnet/teampass

Introduced in: 0

No fixed version published yet for nilsteampassnet/teampass (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-17205[ADVISORY]
https://github.com/nilsteampassnet/TeamPass/issues/2688[WEB]
https://github.com/nilsteampassnet/TeamPass/pull/2739/commits/ecdc6ca5a6e8c4b0b15d48f7e6327bf642fa6312[WEB]
https://github.com/nilsteampassnet/TeamPass[PACKAGE]