PT-2024-34393 · Teampass · Teampass

Published 2024-12-30 · Updated 2024-12-30 · CVE-2024-50702

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: TeamPass versions prior to 3.1.3.1

Description: The issue arises from the software not properly checking if a mail me (also known as action mail) operation is performed on behalf of an administrator or manager. This lack of verification can lead to unauthorized actions.

Recommendations: For versions prior to 3.1.3.1, update to version 3.1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mail me operation to minimize the risk of exploitation.

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2024-50702

GHSA-7RM3-4W6J-8XX4

Affected Products

Teampass

References · 11

• https://github.com/nilsteampassnet/TeamPass/commit/35e2b479f2379545b4132bc30a9d052ba7018bf9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-50702 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50702 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rm3-4w6j-8xx4 · Vendor Advisory
• https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1 · Note
• https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1 · Note
• https://github.com/nilsteampassnet/TeamPass · Note
• https://t.me/cvenotify/105756 · Telegram Post
• https://twitter.com/CVEnew/status/1873753457452372144 · Twitter Post
• https://t.me/cvedetector/13935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1873760923409600786 · Twitter Post