PT-2022-28106 · Unknown · Usememos/Memos

Published 2022-12-28 · Updated 2024-08-20 · CVE-2022-4805

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.1

Description The issue concerns the incorrect use of privileged APIs in the usememos/memos GitHub repository. A user can archive any private memos, delete any shortcut, and edit any shortcut from other users via the API. This allows unauthorized access and modification of sensitive data.

Recommendations For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoints that allow archiving, deleting, and editing shortcuts to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-648

Related Identifiers

CVE-2022-4805

GHSA-MQ5Q-GPGV-PWXW

GO-2023-1292

Affected Products

Usememos/Memos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4805.json · Exploit
• 🔥 https://huntr.dev/bounties/b03f6a9b-e49b-42d6-a318-1d7afd985873 · Exploit
• https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4805 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq5q-gpgv-pwxw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1292 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://t.me/cibsecurity/55485 · Telegram Post
• https://github.com/advisories/GHSA-mq5q-gpgv-pwxw · Note
• https://t.me/cvenotify/40909 · Telegram Post