PT-2022-27994 · Unknown · Usememos/Memos

Published 2022-12-23 · Updated 2024-08-21 · CVE-2022-4685

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.0

Description The issue concerns improper access control in the usememos/memos GitHub repository. This allows unauthorized access to certain resources. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources within the repository until the update is applied.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-4685

GHSA-9V48-2H5X-FVPM

GO-2022-1205

Affected Products

Usememos/Memos

References · 9

• https://osv.dev/vulnerability/GO-2022-1205 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9v48-2h5x-fvpm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4685 · Security Note
• https://github.com/usememos/memos · Note
• https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 · Note
• https://t.me/cibsecurity/55237 · Telegram Post
• https://huntr.dev/bounties/015dbf52-8924-4aad-86d7-892cb61157af · Note
• https://github.com/advisories/GHSA-9v48-2h5x-fvpm · Note
• https://t.me/cvenotify/40491 · Telegram Post