Improper Privilege Management in TeamPass - CVE-2017-15053
Published: November 27, 2017 / Updated: July 17, 2020
Vulnerability identifier: #VU31392
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-15053
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
TeamPass
TeamPass
Software vendor:
Nils Laumaillé
Nils Laumaillé
Description
The vulnerability allows a remote privileged user to manipulate data.
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_role" on roles.queries.php.
Remediation
Install update from vendor's website.