PT-2022-28048 · Unknown · Usememos/Memos

Published 2022-12-25 · Updated 2024-08-21 · CVE-2022-4734

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.1

Description The issue concerns the exposure of sensitive user information, including names, email, role, and OpenID, to an authenticated user. This is due to improper removal of sensitive information before storage or transfer. A patch is available to address this issue.

Recommendations For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the endpoint that leaks user information until the patch is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-212

Related Identifiers

CVE-2022-4734

GHSA-J593-H5V3-45X6

GO-2022-1220

Affected Products

Usememos/Memos

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4734.json · Exploit
• 🔥 https://huntr.dev/bounties/4b4421dc-73af-4dec-884c-836f9732cb5b · Exploit
• https://github.com/usememos/memos/commit/05b41804e33a34102f1f75bb2d69195dda6a1210 · Patch
• https://osv.dev/vulnerability/GHSA-j593-h5v3-45x6 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4734 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4734 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://t.me/cvenotify/54891 · Telegram Post
• https://t.me/cvenotify/54478 · Telegram Post
• https://t.me/cvenotify/40783 · Telegram Post
• https://t.me/cibsecurity/55412 · Telegram Post
• https://github.com/advisories/GHSA-j593-h5v3-45x6 · Note