CVE-2023-3553 Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass
An attacker can access sensitive information in TeamPass without authorization, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3553?
CVE-2023-3553 is a medium-severity vulnerability in Teampass Teampass, published on 8 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Weakness: CWE-200
Which versions are affected by CVE-2023-3553?
2 open source packages ship an affected version, including nilsteampassnet/teampass. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nilsteampassnet/teampass Packagist | All versions | 3.0.10 |
nilsteampassnet/teampass Packagist | All versions | 3.0.10 |
Products include Teampass Teampass.
How do I fix CVE-2023-3553?
Upgrade nilsteampassnet/teampass to 3.0.10 or later.
Is CVE-2023-3553 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3553 exists.
Other vulnerabilities in Teampass Teampass
Sources
Also known as GHSA-2rhg-hqq9-8xjh.