GitHub Advisoryadvisory · Packagist

GHSA-gmr7-m73x-6c9q Missing Authorization in TeamPass

HIGH Published 2021-07-26 Modified 2021-07-26 Official page ↗
Aliases
CVE-2020-11671
Ecosystem
Packagist
Packages
nilsteampassnet/teampass
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862
Reviewed
2021-07-26

Affected packages

• Packagist nilsteampassnet/teampass: <= 2.1.27.36 (no fix yet)

Description

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.

Related

Alias · CVE (1)

  • CVE-2020-11671 Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References