PatchTheCVEteleport vulnerabilities and fixes
Recent CVEs affecting teleport, with upgrade or downgrade steps. 4 tracked.
teleport has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2022-12-08. Highest priority: CVE-2022-36633 (score 61/100).
- CVE-2022-38599 MEDIUM 6.5 DOWNGRADE Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via
- CVE-2022-36633 HIGH 8.8 UPGRADE Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution
- CVE-2018-19555 HIGH 8.8 DOWNGRADE tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator pass
- CVE-2018-19301 MEDIUM 6.1 DOWNGRADE tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrat
FAQ
How do I fix teleport vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is teleport being exploited right now?
None of the tracked teleport CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which teleport CVE should I patch first?
CVE-2022-36633 currently ranks highest (61/100): Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution.