CVE-2014-3771

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-08-07 · updated 2026-06-17
Weakness: CWE-264

Description

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) request to index.php or (2) "change_user_language" request to sources/main.queries.php.

Affected products

nilsteampassnet/teampass: through 2.1.20; 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+6)

References

http://teampass.net/installation/2.1.20-released.html
http://www.openwall.com/lists/oss-security/2014/05/18/2
http://www.openwall.com/lists/oss-security/2014/05/19/5
https://github.com/nilsteampassnet/TeamPass/commit/fd549b245c0f639a8d47bf4f74f92c37c053706f
http://teampass.net/installation/2.1.20-released.html
http://www.openwall.com/lists/oss-security/2014/05/18/2
http://www.openwall.com/lists/oss-security/2014/05/19/5
https://github.com/nilsteampassnet/TeamPass/commit/fd549b245c0f639a8d47bf4f74f92c37c053706f

Get alerted when CVE-2014-3771 or the next vulnerability affects your stack