GHSA-rgj5-jj5q-v3v7

Memos Cross-site Scripting vulnerability

At a glance

Published: 2022-12-19 12:30 UTC
Updated: 2023-11-08 04:10 UTC
CVE: CVE-2022-4609
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Memos, an open-source, self-hosted memo hub, is vulnerable to stored Cross-site Scripting (XSS) in versions 0.8.3 and prior. A patch is available and anticipated to be part of version 0.9.0.

Affected packages

Package	Versions
Go · github.com/usememos/memos	introduced 0, last affected 0.8.3

References

https://nvd.nist.gov/vuln/detail/CVE-2022-4609 ADVISORY
https://github.com/usememos/memos/commit/726285e63467820f94cbf872abe71025a161c212 WEB
https://github.com/usememos/memos PACKAGE
https://huntr.dev/bounties/5b3115c5-776c-43d3-a7be-c8dc13ab81ce WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database