Lucene search
TrumthiphiEFE8001B-1D6A-41AF-A64C-736705CC66A6HistoryDec 26, 2022 - 6:45 a.m.
Delete all note of all user in application
2022-12-2606:45:39
trumthiphi
www.huntr.dev
15
user permission
api
data deletion
0.001 Low
EPSS
Percentile
29.2%
Description
A user with login permission can delete all notes of the whole application via API DELETE https://demo.usememos.com/api/memo/$idnote
Proof of Concept
Link: https://drive.google.com/file/d/1P0MvqadCdTo1yxK9VBkm5ntwBvJMSZa8/view?usp=sharing
Related
osv
osv
usememos/memos makes Incorrect Use of Privileged APIs
2022-12-28 15:30:45
CVE-2022-4796
2022-12-28 14:15:09
nvd
nvd
CVE-2022-4796
2022-12-28 14:15:09
veracode
veracode
Privilege Escalation
2023-01-02 15:01:11
cve
cve
CVE-2022-4796
2022-12-28 14:15:09
prion
prion
Code injection
2022-12-28 14:15:00
github
github
usememos/memos makes Incorrect Use of Privileged APIs
2022-12-28 15:30:45
cvelist
cvelist
CVE-2022-4796 Incorrect Use of Privileged APIs in usememos/memos
2022-12-28 00:00:00