GitHub Advisoryadvisory · Go

GHSA-j2gj-g3p9-7mrr Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

CRITICAL Published 2023-09-01 Modified 2023-09-01 Official page ↗
Aliases
CVE-2023-4696
Ecosystem
Go
Packages
github.com/usememos/memos
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2023-09-01

Affected packages

• Go github.com/usememos/memos: < 0.13.2 → fixed in 0.13.2

Description

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit `c9aa2eeb9` access tokens which fail validation are rejected.

Related

Alias · CVE (1)

  • CVE-2023-4696 Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References