teleport
NPM
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| = 3.6.3, = 3.5.6, = 3.2.2 | 6.5 MEDIUM | — | ||
Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface. | ||||
| < 10.1.2 | 8.8 HIGH | — | ||
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload. | ||||
| >= 6.0, < 6.2.12, >= 7.0, < 7.1.1, < 4.4.11, >= 5.0, < 5.2.4 | 9.8 CRITICAL | 7.5 HIGH | ||
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations. | ||||
| >= 6.0, < 6.2.12, >= 7.0, < 7.1.1, < 4.4.11, >= 5.0, < 5.2.4 | 5.3 MEDIUM | 5 MEDIUM | ||
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations. | ||||
| >= 6.0, < 6.2.12, >= 7.0, < 7.1.1 | 6.5 MEDIUM | 6.4 MEDIUM | ||
Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username. | ||||