CVE-2014-3772

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
VendorProductVersion
teampassteampass
𝑥
≤ 2.1.20
teampassteampass
2.1
teampassteampass
2.1.1
teampassteampass
2.1.2
teampassteampass
2.1.3
teampassteampass
2.1.4
teampassteampass
2.1.5
teampassteampass
2.1.10
teampassteampass
2.1.13
teampassteampass
2.1.14
teampassteampass
2.1.15
teampassteampass
2.1.18
teampassteampass
2.1.19
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://teampass.net/installation/2.1.20-released.html
http://www.openwall.com/lists/oss-security/2014/05/18/2
http://www.openwall.com/lists/oss-security/2014/05/19/5
https://github.com/nilsteampassnet/TeamPass/commit/7715512f2bd5659cc69e063a1c513c19e384340f
http://teampass.net/installation/2.1.20-released.html
http://www.openwall.com/lists/oss-security/2014/05/18/2
http://www.openwall.com/lists/oss-security/2014/05/19/5
https://github.com/nilsteampassnet/TeamPass/commit/7715512f2bd5659cc69e063a1c513c19e384340f