PT-2022-27999 · Unknown · Usememos/Memos

Published 2022-12-23 · Updated 2024-08-21 · CVE-2022-4688

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.0

Description The issue concerns improper authorization in the usememos/memos GitHub repository. This repository is for an open-source, self-hosted memo hub that includes knowledge management and socialization features. The improper authorization can allow a user to modify other users' nicknames, usernames, and email addresses without permission.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the improper authorization issue. As a temporary workaround, consider restricting access to user modification functions until the update can be applied.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2022-4688

GHSA-VWG4-846X-F94V

GO-2022-1190

Affected Products

Usememos/Memos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4688.json · Exploit
• 🔥 https://huntr.dev/bounties/23856e7e-94ff-4dee-97d0-0cd47e9b8ff6 · Exploit
• https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4688 · Security Note
• https://osv.dev/vulnerability/GHSA-vwg4-846x-f94v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4688 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1190 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://t.me/cvenotify/40488 · Telegram Post
• https://github.com/advisories/GHSA-vwg4-846x-f94v · Note
• https://t.me/cibsecurity/55238 · Telegram Post