PT-2023-1646 · Teampass · Teampass

Published 2023-01-22 · Updated 2023-03-07 · CVE-2023-1070

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 3.0.0.22

Description The issue is related to external control of file name or path in the TeamPass password manager, which can be exploited by a remote attacker to delete arbitrary files.

Recommendations For versions prior to 3.0.0.22, update to version 3.0.0.22 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

BDU:2023-01182

CVE-2023-1070

GHSA-X36G-4629-XP9V

Affected Products

Teampass

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1070.json · Exploit
• 🔥 https://huntr.dev/bounties/318bfdc4-7782-4979-956f-9ba2cc44889c · Exploit
• https://github.com/nilsteampassnet/teampass/commit/0af3574caba27a61b16dc25c94fa51ae12d2d967 · Patch
• https://osv.dev/vulnerability/GHSA-x36g-4629-xp9v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1070 · Security Note
• https://bdu.fstec.ru/vul/2023-01182 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1070 · Vendor Advisory
• https://github.com/nilsteampassnet/teampass · Note
• https://github.com/advisories/GHSA-x36g-4629-xp9v · Note
• https://advisories.gitlab.com/advisory/advpackagist_nilsteampassnet_teampass_CVE_2023_1070.html · Note
• https://t.me/cvenotify/45732 · Telegram Post