CVE-2020-12478

HIGHNuclei

TeamPass files are available without authentication

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2020-12478 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

nilsteampassnet/teampass

Browse Packagist / nilsteampassnet/teampass
GitHub Advisory2.1.27.36affected

Nuclei templates

1
ProjectDiscoveryHIGHTeamPass 2.1.27.36 - Improper AuthenticationCVSS 7.5

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can bypass authentication and gain unauthorized access to sensitive information.

Remediation

Upgrade to a patched version of TeamPass or apply the recommended security patches.

WeaknessesCWE-306
Authorsarafatansari
Template tagscve2020cveteampassexposureunauthvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:teampass:teampass:2.1.27.36:*:*:*:*:*:*:*
Shodan: http.html:"teampass"
FOFA: body="teampass"
https://github.com/nilsteampassnet/TeamPass/issues/2764 https://nvd.nist.gov/vuln/detail/CVE-2020-12478 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates https://github.com/StarCrossPortal/scalpel

Source: ProjectDiscovery

References

3