GitHub Advisoryadvisory · Go

GHSA-w57v-6xp4-rm2v usememos/memos vulnerable to account takeover due to improper access control

HIGH Published 2022-12-23 Modified 2023-01-02 Official page ↗
Aliases
CVE-2022-4689
Ecosystem
Go
Packages
github.com/usememos/memos
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2022-12-27

Affected packages

• Go github.com/usememos/memos: < 0.9.0 → fixed in 0.9.0

Description

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.

Related

Alias · CVE (1)

  • CVE-2022-4689 Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References