medium5.4
CVE-2019-16904
TeamPass Cross-site Scripting (XSS) vulnerability
Impact
TeamPass 2.1.27.36 allows XSS by setting a crafted password for an item in a folder, and then sharing that item with an admin. (The crafted password is exploitable when viewing the change history, or the previous used password field.)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | nilsteampassnet/teampass | <= 2.1.27.36 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teampass | Teampass | Version 2.1.27.36 |