usememos/memos · Security
usememos/memos missing Secure cookie attribute
- GHSA ID
- GHSA-qcw2-492v-57xj
- CVE ID
- CVE-2022-4683
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking.
CWEs
- CWE-311 · Missing Encryption of Sensitive Data
- CWE-319 · Cleartext Transmission of Sensitive Information
- CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute