CVE-2017-15055
HighSummary
TeamPass versions before 2.1.27.9 do not properly enforce item access control in items.queries.php. This allows an attacker to copy arbitrary items, edit them in read-only directories, delete items, and access the history and attributes of directories.
Risk Assessment
This vulnerability allows unauthorized operations on items, potentially leading to data loss and breaches of confidentiality within the organization.
Recommendation
It is recommended to update TeamPass to version 2.1.27.9 or later to mitigate this vulnerability.
Other vulnerabilities in TeamPass
See all- CVE-2017-15054High
An arbitrary file upload vulnerability in TeamPass before version 2.1.27.9 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.
- CVE-2015-7563High
CVE-2015-7563 describes a CSRF vulnerability in TeamPass version 2.1.24 and earlier that allows remote attackers to hijack the authentication of an authenticated user.
- CVE-2014-3773High
Multiple SQL injection vulnerabilities in TeamPass before version 2.1.20 allow remote attackers to execute arbitrary SQL commands through various parameters in PHP files.
- CVE-2014-3772High
TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key.
- CVE-2014-3771High
TeamPass before version 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a request to index.php or in a 'change_user_language' request to sources/main.queries.php.
- CVE-2017-9436Critical
TeamPass versions before 2.1.27.4 are vulnerable to a SQL injection in users.queries.php.
Original NVD description (English source)
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the "item_id" parameter when invoking "copy_item" on items.queries.php.