PT-2023-2987 · Teampass · Teampass

Published 2023-05-31 · Updated 2023-06-06 · CVE-2023-3009

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions teampass versions prior to 3.0.9

Description The issue is related to a Cross-site Scripting (XSS) - Stored vulnerability in the teampass GitHub repository. This vulnerability is associated with the lack of protection measures for the web page structure, allowing a remote attacker to perform inter-site script attacks. The exploitation of this vulnerability enables an attacker to inject malicious code into a shared folder, which can then be executed by other users who have access to the folder.

Recommendations For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to shared folders to minimize the risk of exploitation. Avoid using shared folders until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-03011

CVE-2023-3009

GHSA-H5G9-2P35-54C7

Affected Products

Teampass

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3009.json · Exploit
• 🔥 https://huntr.dev/bounties/2929faca-5822-4636-8f04-ca5e0001361f · Exploit
• https://github.com/nilsteampassnet/teampass/commit/6ba8cf1f4b89d62a08d122d533ccf4cb4e26a4ee · Patch
• https://osv.dev/vulnerability/CVE-2023-3009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5g9-2p35-54c7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3009 · Security Note
• https://github.com/nilsteampassnet/TeamPass · Note
• https://vuldb.com/ru/?id.230370 · Note
• https://t.me/cvenotify/51468 · Telegram Post
• https://t.me/cybersecuritytechnologies/8402 · Telegram Post
• https://t.me/cibsecurity/64815 · Telegram Post