CVE-2020-11671
CVE-2020-11671
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
CVSS 8.1 · High · EPSS 1.1%
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
nilsteampassnet/teampass Packagist
- Versions
- 2.1.21
- 2.1.26
- 2.1.27
- Affected ranges
- ECOSYSTEM: ≤ 2.1.27.36
No fix published