PT-2023-31535 · Unknown · Usememos/Memos

Published 2023-09-18 · Updated 2024-08-21 · CVE-2023-5036

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions usememos/memos versions prior to 0.15.1

Description The issue is related to Cross-Site Request Forgery (CSRF) in the usememos/memos repository. It affects the getimage endpoint. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.15.1, update to version 0.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the getimage endpoint until the update is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-5036

GHSA-2G7R-9XQ5-C6HV

GO-2023-2065

Affected Products

Usememos/Memos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5036.json · Exploit
• 🔥 https://huntr.dev/bounties/46881df7-eb41-4ce2-a78f-82de9bc4fc2d · Exploit
• https://github.com/usememos/memos/commit/97b434722cf0abe3cfcad5ac9e3d520233bf1536 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-5036 · Security Note
• https://osv.dev/vulnerability/GO-2023-2065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5036 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2g7r-9xq5-c6hv · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://twitter.com/vicskav/status/1708197849161195616 · Twitter Post
• https://github.com/advisories/GHSA-2g7r-9xq5-c6hv · Note
• https://t.me/cibsecurity/70637 · Telegram Post