PT-2023-30272 · Unknown · Usememos/Memos

Publicado 2023-08-31 · Atualizado 2024-08-21 · CVE-2023-4696

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.13.2

Description The issue is related to improper access control in the GitHub repository usememos/memos. It allows for account takeover due to improper handling of JWT tokens. As of commit c9aa2eeb9, access tokens that fail validation are rejected.

Recommendations For versions prior to 0.13.2, update to version 0.13.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive features that rely on JWT tokens until the update is applied.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-4696

GHSA-J2GJ-G3P9-7MRR

GO-2023-2038

Produtos afetados

Usememos/Memos

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4696.json · Exploit
• https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd · Correção
• https://osv.dev/vulnerability/GHSA-j2gj-g3p9-7mrr · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1697415285098131687 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1697485060234940807 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4696 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4696 · Nota de Segurança
• https://twitter.com/HunterMapping/status/1698274643306553813 · Publicação no Twitter
• https://osv.dev/vulnerability/GO-2023-2038 · Aviso do Fabricante
• https://github.com/advisories/GHSA-j2gj-g3p9-7mrr · Nota
• https://huntr.dev/bounties/4747a485-77c3-4bb5-aab0-21253ef303ca · Nota
• https://t.me/pentestingnews/39004 · Publicação no Telegram