Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2023-3191: TeamPass before 3.0.9 can run hidden code in pages
CVE-2023-3191 · published 3 years ago
Summary
TeamPass versions older than 3.0.9 allow a user to store malicious script that is later shown to other users. When the script runs, it can steal login details or perform actions on behalf of the victim. Update TeamPass to version 3.0.9 or later, or remove any untrusted content from the system immediately.
What to do
- Update nilsteampassnet teampass to version 3.0.9.
- Update teampass teampass to version 3.0.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | nilsteampassnet | teampass |
< 3.0.9 Fix: upgrade to 3.0.9
|
| – | teampass | teampass |
< 3.0.9 cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
References
- https://github.com/advisories/GHSA-qmw8-x364-xxxm
- https://huntr.dev/bounties/19fed157-128d-4bfb-a30e-eadf748cbd1a URL
- https://nvd.nist.gov/vuln/detail/CVE-2023-3191 Vendor Advisory
- https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3191.j... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta