Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2023-3084: TeamPass can be tricked to run unwanted code
CVE-2023-3084 · published 3 years ago
Summary
TeamPass’s web interface can store data that is later shown to other users without proper cleaning. An attacker could place hidden code that runs in a victim’s browser, potentially exposing passwords or other confidential information. Upgrade TeamPass to version 3.0.9 or later (or apply the vendor’s patch) and keep browsers set to block unwanted scripts.
What to do
- Update nilsteampassnet teampass to version 3.0.9.
- Update teampass teampass to version 3.0.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | nilsteampassnet | teampass |
< 3.0.9 Fix: upgrade to 3.0.9
|
| – | teampass | teampass |
< 3.0.9 cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
References
- https://github.com/advisories/GHSA-8vm8-38pc-8xhh
- https://huntr.dev/bounties/4b86b56b-c51b-4be8-8ee4-6e385d1e9e8a URL
- https://nvd.nist.gov/vuln/detail/CVE-2023-3084 Vendor Advisory
- https://github.com/nilsteampassnet/teampass/commit/61b9b7d4e33bbaad2cd61a7ee988f... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3084.j... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta