Lucene search

GitHub Advisory DatabaseGHSA-68GW-R2X5-7R5R

HistoryDec 23, 2022 - 12:30 p.m.

usememos/memos Authorization Bypass Through User-Controlled Key vulnerability

2022-12-2312:30:25

CWE-639

GitHub Advisory Database

github.com

authorization

bypass

user-controlled

key

github

repository

usememos

memos

software

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.4%

JSON

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.

Affected configurations

Vulners

Node

usememosmemosRange<0.9.0

CPENameOperatorVersion
github.com/usememos/memoslt0.9.0

CPE	Name	Operator	Version
	github.com/usememos/memos	lt	0.9.0

References

github.com/advisories/GHSA-68gw-r2x5-7r5r

github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9

huntr.dev/bounties/caa0b22c-501f-44eb-af65-65c315cd1637

nvd.nist.gov/vuln/detail/CVE-2022-4686

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

54.4%

JSON

Related for GHSA-68GW-R2X5-7R5R