Reflected XSS Vulnerability in TeamPass by Teampass
CVE-2022-26980

6.1MEDIUM

Key Information:

Vendor

Teampass

Status
Teampass
Vendor
CVE Published:
28 March 2022

What is CVE-2022-26980?

The TeamPass application version 2.1.26 contains a vulnerability that allows attackers to exploit reflected XSS through the index.php PATH_INFO parameter. By manipulating the input, attackers can execute arbitrary scripts in the user's browser session, leading to potential data leakage or malicious actions carried out in the context of the user's session. This issue underscores the importance of implementing proper input validation and sanitization to mitigate XSS risks.

References

https://github.com/nilsteampassnet/TeamPass/commits/teamp...
x_refsource_MISC
https://gist.github.com/RNPG/6919286e0daebce7634d0a744e06...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.