TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php.

References

• https://nvd.nist.gov/vuln/detail/CVE-2014-3772
• nilsteampassnet/TeamPass@7715512
• http://teampass.net/installation/2.1.20-released.html
• http://www.openwall.com/lists/oss-security/2014/05/18/2
• http://www.openwall.com/lists/oss-security/2014/05/19/5