Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2017-15055

TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the "item_id" parameter when invoking "copy_item" on items.queries.php.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2017-15055
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 09:53 UTC · Revision 1

Source evidence

CVE-2017-15055

core-osv · Original source

Published 27 Nov 2017, 19:29 UTC

TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the "item_id" parameter when invoking "copy_item" on items.queries.php.

osv:CVE-2017-15055
Complete source record
{
  "id": "538ee7892b90ceeed37a2c2f6f22757cfd99c6ebf61546f36ca05fcfaf733e3a",
  "url": "https://osv.dev/vulnerability/CVE-2017-15055",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2017-15055",
    "summary": "TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the \"item_id\" parameter when invoking \"copy_item\" on items.queries.php.",
    "evidence": "osv:CVE-2017-15055",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2017-15055",
      "aliases": [
        "CVE-2017-15055",
        "GHSA-7ghm-6p42-h226"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nilsteampassnet/teampass",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "f7828f2e1666b8b0b2962b55d088409771378a9c"
                },
                {
                  "fixed": "5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.1.27.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2.1.27.8",
            "2.1.27.7",
            "2.1.27.6",
            "2.1.27.5",
            "2.1.27.4",
            "2.1.27.3",
            "2.1.27.2",
            "2.1.27.1",
            "2.1.27.0",
            "2.1.26-final-3",
            "2.1.26-final-2",
            "2.1.26-final",
            "2.1.26",
            "2.1.26.17",
            "2.1.26.16",
            "2.1.26.15",
            "2.1.26.14",
            "2.1.26.13",
            "2.1.26.12",
            "2.1.26.11",
            "2.1.26.10",
            "2.1.26.9",
            "2.1.26.8",
            "2.1.26.7",
            "2.1.26.6",
            "2.1.26.5",
            "2.1.26.4",
            "2.1.26.3",
            "2.1.26.2",
            "2.1.26.1",
            "2.1.26.0",
            "2.1.25.2",
            "2.1.25.1",
            "2.1.25.0",
            "2.1.20"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15055.json"
          }
        }
      ],
      "modified": "2026-10-20T10:48:17.467072479Z",
      "provider": "osv",
      "references": [
        "https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15f"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2017-15055",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 380258,
  "published_at": "2017-11-27T19:29:00.393+00:00"
}