usememos/memos · Security
usememos/memos makes Incorrect Use of Privileged APIs
- GHSA ID
- GHSA-ghx2-6v4g-9wmm
- CVE ID
- CVE-2022-4796
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Description
In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via API DELETE https://demo.usememos.com/api/memo/$idnote. The vulnerability will lose all user notes data throughout the system, causing damage to user data.
CWEs
- CWE-648 · Incorrect Use of Privileged APIs