PT-2020-13138 · Php · Teampass

Bstapes · Published 2020-04-29 · Updated 2022-05-24 · CVE-2020-12479

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36

Description The issue allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php using newValue directory traversal.

Recommendations For TeamPass version 2.1.27.36, as a temporary workaround, consider restricting access to the sources/users.queries.php file until a patch is available. Avoid using the newValue parameter in the affected HTTP request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12479

GHSA-6JF9-8M34-96W5

Affected Products

Teampass

References · 7

• 🔥 https://github.com/nilsteampassnet/TeamPass/issues/2762 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12479 · Security Note
• https://osv.dev/vulnerability/GHSA-6jf9-8m34-96w5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12479 · Vendor Advisory
• https://github.com/nilsteampassnet/TeamPass · Note
• https://github.com/nilsteampassnet/TeamPass/pull/2874 · Note
• https://t.me/cvenotify/3431 · Telegram Post