Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject…

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.

Scores

EPSS (exploitation in 30 days)

0.95% · top 39% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• n/a
• CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Packagistnilsteampassnet/teampassGHSA-r68m-4v39-cf43 (opens in a new tab)

References (2)

• http://blog.amossys.fr/teampass-multiple-cve-01.html (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-r68m-4v39-cf43 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-15051](https://trackcve.app/badge/CVE-2017-15051.svg)](https://trackcve.app/cve/CVE-2017-15051)

Record last updated 5 Aug 2024, 19:42 UTC.