PT-2022-27987 · Unknown · Usememos/Memos

Published 2022-12-23 · Updated 2024-08-21 · CVE-2022-4683

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.0

Description The issue is related to a sensitive cookie in an HTTPS session without the 'Secure' attribute. This affects an open-source, self-hosted memo hub with knowledge management and socialization capabilities. The missing Secure cookie attribute makes it vulnerable to session hijacking.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive cookies until the update is applied.

Exploit

Fix

Missing Encryption of Sensitive Data

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-614

CWE-311

CWE-319

Related Identifiers

CVE-2022-4683

GHSA-QCW2-492V-57XJ

GO-2022-1192

Affected Products

Usememos/Memos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4683.json · Exploit
• 🔥 https://huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6ef · Exploit
• https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2e · Patch
• https://osv.dev/vulnerability/GO-2022-1192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4683 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4683 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcw2-492v-57xj · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://t.me/cibsecurity/55234 · Telegram Post
• https://t.me/cvenotify/40493 · Telegram Post
• https://github.com/advisories/GHSA-qcw2-492v-57xj · Note