CVE-2020-12479

Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36

Description The issue allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php using newValue directory traversal.

Recommendations For TeamPass version 2.1.27.36, as a temporary workaround, consider restricting access to the sources/users.queries.php file until a patch is available. Avoid using the newValue parameter in the affected HTTP request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.