GitHub Advisoryadvisory · Packagist
GHSA-83h6-22cp-f22w TeamPass files are available without authentication
HIGH
Official page ↗
- Aliases
- CVE-2020-12478
- Ecosystem
- Packagist
- Packages
- nilsteampassnet/teampass
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-306
- Reviewed
- 2024-04-24
Affected packages
• Packagist nilsteampassnet/teampass: 2.1.27.36 (no fix yet)
Description
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
Related
Alias · CVE (1)
- CVE-2020-12478 TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. vulnerability
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness