PT-2021-5423 · Unknown · Team Password Manager

Stefan Walter · Published 2021-10-17 · Updated 2021-11-23 · CVE-2021-44037

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 10.135.236

Description The issue is related to an insufficient password reset mechanism in the Team Password Manager application. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information by resetting passwords.

Recommendations For versions prior to 10.135.236, update to version 10.135.236 or later to resolve the issue. As a temporary workaround, consider restricting access to the password reset feature until a patch is applied.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2021-06266

CVE-2021-44037

Affected Products

Team Password Manager

References · 11

• https://bdu.fstec.ru/vul/2021-06266 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44037 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20211130.10.pdf · Security Note
• https://teampasswordmanager.com/docs/changelog/#10.135.236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44037 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021112612 · Note
• https://t.me/cvenotify/23638 · Telegram Post
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-060.txt · Note
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-060 · Note
• https://t.me/cibsecurity/32726 · Telegram Post
• https://t.me/cvenotify/23501 · Telegram Post