CVE-2017-15051 TeamPass stored cross-site scripting (XSS) vulnerability
Authenticated attackers can inject malicious scripts via item URLs or profile logs, potentially compromising administrator sessions in TeamPass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15051?
CVE-2017-15051 is a medium-severity cross-site scripting vulnerability in Teampass Teampass, published on 27 Nov 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.
Weakness: CWE-79
Which versions are affected by CVE-2017-15051?
2 open source packages ship an affected version, including nilsteampassnet/teampass. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nilsteampassnet/teampass Packagist | All versions | 2.1.27.9 |
nilsteampassnet/teampass Packagist | All versions | 2.1.27.9 |
Products include Teampass Teampass.
How do I fix CVE-2017-15051?
Upgrade nilsteampassnet/teampass to 2.1.27.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-15051 being exploited?
There is no known exploitation of CVE-2017-15051 in the wild and no public exploit code.
Other vulnerabilities in Teampass Teampass
Sources
Also known as GHSA-r68m-4v39-cf43.