PT-2022-28113 · Unknown · Usememos/Memos

Boojack · Published 2022-12-28 · Updated 2024-08-21 · CVE-2022-4812

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.9.1

Description The issue is related to a Comparison of Object References Instead of Object Contents, which can lead to an Authorization Bypass Through User-Controlled Key. This allows for potential unauthorized access. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.9.1, update to version 0.9.1 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-595

Related Identifiers

CVE-2022-4812

GHSA-M5PR-WM6Q-X4G2

GO-2022-1260

Affected Products

Usememos/Memos

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4812.json · Exploit
• 🔥 https://huntr.dev/bounties/33924891-5c36-4b46-b417-98eaab688c4c · Exploit
• https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53 · Patch
• https://osv.dev/vulnerability/GHSA-m5pr-wm6q-x4g2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4812 · Security Note
• https://osv.dev/vulnerability/GO-2022-1260 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4812 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://t.me/cvenotify/40902 · Telegram Post
• https://t.me/cvenotify/45324 · Telegram Post
• https://t.me/cibsecurity/55480 · Telegram Post
• https://github.com/advisories/GHSA-m5pr-wm6q-x4g2 · Note