CVE-2015-7562 TeamPass vulnerable to Cross-site Scripting

What is CVE-2015-7562?

CVE-2015-7562 is a medium-severity cross-site scripting vulnerability in Teampass Teampass, published on 12 Apr 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.

Weakness: CWE-79

Which versions are affected by CVE-2015-7562?

2 open source packages ship an affected version, including nilsteampassnet/teampass. It affects 1 product.

Products include Teampass Teampass.

How do I fix CVE-2015-7562?

Upgrade nilsteampassnet/teampass to 2.1.25 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2015-7562 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-7562 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Teampass Teampass

• CVE-2019-1000001 TeamPass Storing Passwords in a Recoverable Format vulnerability Critical 9.8
• CVE-2017-9436 TeamPass SQL injection in users.queries.php Critical 9.8
• CVE-2015-7564 TeamPass vulnerable to SQL Injection Critical 9.8
• CVE-2026-3106 Multiple vulnerabilities in Teampass Critical 9.3
• CVE-2026-3107 Multiple vulnerabilities in Teampass Critical 9.3

All Teampass Teampass vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-48q3-m4hf-56c9.