GHSA-w57v-6xp4-rm2v
usememos/memos vulnerable to account takeover due to improper access control
At a glance
- Published
- Updated
- CVE
- CVE-2022-4689
- Aliases
- GO-2022-1191
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/usememos/memos | introduced 0, fixed 0.9.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-4689 ADVISORY
- https://github.com/usememos/memos/pull/831 WEB
- https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 WEB
- https://github.com/usememos/memos PACKAGE
- https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |