GitHub Advisoryadvisory · Packagist

GHSA-q9qr-h33g-fw3j TeamPass Storing Passwords in a Recoverable Format vulnerability

CRITICAL Published 2022-05-13 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-1000001
Ecosystem
Packagist
Packages
nilsteampassnet/teampass
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2024-04-24

Affected packages

• Packagist nilsteampassnet/teampass: <= 2.1.27 (no fix yet)

Description

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.

Related

Alias · CVE (1)

  • CVE-2019-1000001 TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References