Lucene search
Trumthiphi0FBA72B9-DB10-4D9F-A707-2ACF2004A286HistoryDec 26, 2022 - 7:36 a.m.
Get all file in resource of any user and Delete any file of any user via IDOR
2022-12-2607:36:50
trumthiphi
www.huntr.dev
10
information disclosure
api exploitation
idor vulnerability
0.001 Low
EPSS
Percentile
34.8%
Description
Easily GET information of all files uploaded by all users in Resources via API https://demo.usememos.com/api/resource/$id_resource (method GET)
Easily DELETE of all files uploaded by all users in Resources via API https://demo.usememos.com/api/resource/$id_resource (method DELETE)
Proof of Concept
PoC link: https://drive.google.com/file/d/117gzDOyAE890kLgDYe46hOeRcdyjZX38/view?usp=sharing
Related
veracode
veracode
Improper Access Control
2023-01-02 14:52:49
prion
prion
Authorization
2022-12-28 14:15:00
nvd
nvd
CVE-2022-4803
2022-12-28 14:15:10
cve
cve
CVE-2022-4803
2022-12-28 14:15:10
cvelist
cvelist
osv
osv
CVE-2022-4803
2022-12-28 14:15:10
usememos/memos Improper Access Control vulnerability
2022-12-28 15:30:45
github
github
usememos/memos Improper Access Control vulnerability
2022-12-28 15:30:45