{"id":"GHSA-4h2q-84w7-4mhx","aliases":["CVE-2023-2021"],"title":"nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS)","description":"nilsteampassnet/teampass prior to 3.0.3 is vulnerable to stored cross-site scripting (XSS) in the description parameter of a folder. ","severity":"medium","score":5.8,"published":"2023-04-13T12:30:35.000Z","modified":"2023-11-08T04:11:22.008Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"nilsteampassnet/teampass","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.3"}],"type":"ECOSYSTEM"}],"versions":["2.1.21","2.1.26","2.1.27","3.0.0","3.0.0.10","3.0.0.11"],"fixed":["3.0.3"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2023-2021","https://github.com/nilsteampassnet/teampass/commit/77c541a0151841d1f4ceb0a84ca391e1b526d58d","https://github.com/nilsteampassnet/TeamPass","https://huntr.dev/bounties/2e31082d-7aeb-46ff-84d6-9561758e3bf0"],"sources":[{"name":"OSV","id":"GHSA-4h2q-84w7-4mhx","modified":"2023-11-08T04:11:22.008343Z","url":"https://osv.dev/vulnerability/GHSA-4h2q-84w7-4mhx"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","score":5.8}]}