Improper Privilege Management in TeamPass - CVE-2017-15053
Published: November 27, 2017 / Updated: July 17, 2020
Vulnerability identifier: #VU31392
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-15053
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Nils Laumaillé
Affected software:
TeamPass
TeamPass
Detailed vulnerability description
The vulnerability allows a remote privileged user to manipulate data.
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_role" on roles.queries.php.
How to mitigate CVE-2017-15053
Install update from vendor's website.