usememos/memos · Security
usememos/memos vulnerable to account takeover due to improper access control
- GHSA ID
- GHSA-w57v-6xp4-rm2v
- CVE ID
- CVE-2022-4689
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.
CWEs
- CWE-284 · Improper Access Control