CVE-2020-12477

Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36

Description The issue allows any user with a valid API token to bypass IP address whitelist restrictions. This is achieved via an X-Forwarded-For client HTTP header to the getIp function.

Recommendations For TeamPass version 2.1.27.36, consider restricting access to the getIp function until a patch is available. As a temporary workaround, avoid using the X-Forwarded-For client HTTP header in the REST API functions to minimize the risk of exploitation.