Teampass Blind Cross-Site Scripting Vulnerability

A blind cross-site scripting vulnerability has been identified in Teampass versions prior to 3.1.5.16. The issue arises in the password manager's login functionality, specifically within the 'contraseña' parameter of the login form 'redacted/index.php'. During unsuccessful authentication attempts, the application fails to adequately sanitize or encode the username input. This oversight allows arbitrary JavaScript to be executed in the administrator's browser when reviewing failed login attempts, creating a blind XSS condition.

Impact

Exploitation of this vulnerability allows for blind cross-site scripting, where an attacker can execute JavaScript in the context of the administrator's browser, potentially leading to session hijacking or other malicious actions.

Remediation

Users can upgrade to Teampass version 3.1.5.24 to address this vulnerability.