high8.8
CVE-2022-4689
usememos/memos vulnerable to account takeover due to improper access control
Impact
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/usememos/memos | < 0.9.0 | 0.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Usememos | Memos | before 0.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
- https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3
- https://github.com/advisories/GHSA-w57v-6xp4-rm2v
- https://nvd.nist.gov/vuln/detail/CVE-2022-4689
- https://github.com/usememos/memos/pull/831