Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue found in Teampass versions prior to 3.1.5.16. It occurs in the password import functionality at a specific endpoint. The application does not properly sanitize or encode user input during the import process, allowing malicious JavaScript code to be stored persistently in the database.

When other users view the imported passwords, the malicious script executes automatically in their browsers. This stored XSS enables attackers to run arbitrary JavaScript in the context of multiple users and administrators.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of multiple users and administrators, potentially leading to session hijacking, credential theft, privilege abuse, and compromise of application integrity.

Such security breaches can result in unauthorized access to sensitive data, which may violate data protection requirements under regulations like GDPR and HIPAA that mandate the protection of personal and health information.

Therefore, this vulnerability could negatively impact compliance with these standards by exposing sensitive user credentials and compromising the confidentiality and integrity of stored data.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to serious security impacts including session hijacking, credential theft, privilege abuse, and compromise of the application's integrity.

• Attackers can execute arbitrary JavaScript code in users' browsers.
• Attackers may steal user credentials or hijack sessions.
• Attackers can abuse privileges and compromise the application.

Useful 0 Not Useful 0