Lucene search

GitHub Advisory DatabaseGHSA-MFVQ-M3JJ-8864

HistoryDec 28, 2022 - 3:30 p.m.

usememos/memos vulnerable to Improper Verification of Source of a Communication Channel

2022-12-2815:30:45

CWE-940

GitHub Advisory Database

github.com

usememos

memos

software

improper verification

communication channel

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.7%

JSON

usememos/memos 0.9.0 and prior is vulnerable to Improper Verification of Source of a Communication Channel.

Affected configurations

Vulners

Node

usememosmemosRange≤0.9.0

VendorProductVersionCPE
usememosmemos*cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
usememos	memos	*	cpe:2.3:a:usememos:memos::::::::

References

github.com/advisories/GHSA-mfvq-m3jj-8864

github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53

huntr.dev/bounties/aa45a6eb-cc38-45e5-a301-221ef43c0ef8

nvd.nist.gov/vuln/detail/CVE-2022-4800

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.7%

JSON

Related for GHSA-MFVQ-M3JJ-8864