PT-2022-28098 · Unknown · Usememos/Memos

Published 2022-12-28 · Updated 2024-08-21 · CVE-2022-4797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.1

Description The issue concerns an improper restriction of excessive authentication attempts. An attacker can exploit this by deleting other users' posts via post id through brute force.

Recommendations For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to post deletion functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2022-4797

GHSA-QRRF-XVCF-P64Q

GO-2022-1244

Affected Products

Usememos/Memos

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4797.json · Exploit
• 🔥 https://huntr.dev/bounties/5233f76f-016b-4c65-b019-2c5d27802a1b · Exploit
• https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53 · Patch
• https://osv.dev/vulnerability/CVE-2022-4797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4797 · Security Note
• https://osv.dev/vulnerability/GHSA-qrrf-xvcf-p64q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1244 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://github.com/advisories/GHSA-qrrf-xvcf-p64q · Note
• https://t.me/cibsecurity/55487 · Telegram Post