GitHub Advisoryadvisory · Packagist

GHSA-fv48-hjhp-94c7 Incorrect Authorization in TeamPass

HIGH Published 2021-07-26 Modified 2021-07-26 Official page ↗
Aliases
CVE-2020-12477
Ecosystem
Packagist
Packages
nilsteampassnet/teampass
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2021-07-26

Affected packages

• Packagist nilsteampassnet/teampass: <= 2.1.27.36 (no fix yet)

Description

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.

Related

Alias · CVE (1)

  • CVE-2020-12477 The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References