Lucene search

GoogleOSV:GHSA-W57V-6XP4-RM2V

HistoryDec 23, 2022 - 12:30 p.m.

usememos/memos vulnerable to account takeover due to improper access control

2022-12-2312:30:25

Google

osv.dev

open-source

self-hosted

memo hub

knowledge management

socialization

version 0.9.0

access control

http request

software

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

34.8%

JSON

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.

CPENameOperatorVersion
github.com/usememos/memoslt0.9.0

CPE	Name	Operator	Version
	github.com/usememos/memos	lt	0.9.0

References

github.com/usememos/memos

github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9

github.com/usememos/memos/pull/831

huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3

nvd.nist.gov/vuln/detail/CVE-2022-4689

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

34.8%

JSON

Related for OSV:GHSA-W57V-6XP4-RM2V