Stored XSS Vulnerabilities in TeamPass by Teampass.net

CVE-2017-15051

What is CVE-2017-15051?

TeamPass versions prior to 2.1.27.9 are susceptible to multiple stored cross-site scripting vulnerabilities. These vulnerabilities allow authenticated attackers to execute arbitrary script code or HTML by injecting malicious content through the URL field of shared items or via user log history. In the latter case, the attacker must first prepare a harmful payload within their user profile and trick an administrator into making profile modifications. Once the administrator views the log, the malicious script will be executed, potentially compromising the application and user data.

References