What is GHSA-w57v-6xp4-rm2v?

GHSA-w57v-6xp4-rm2v is a security advisory published by GitHub Security Advisories with High severity. usememos/memos vulnerable to account takeover due to improper access control

Which CVE IDs does GHSA-w57v-6xp4-rm2v cover?

GHSA-w57v-6xp4-rm2v covers the following CVE IDs: CVE-2022-4689. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w57v-6xp4-rm2v?

GHSA-w57v-6xp4-rm2v has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-w57v-6xp4-rm2v?

GHSA-w57v-6xp4-rm2v affects 1 product, including: go/github.com/usememos/memos:\u003c 0.9.0.

GHSA-w57v-6xp4-rm2vHighCVSS 8.8

usememos/memos vulnerable to account takeover due to improper access control

Vendor

GitHub Security Advisories

Published

December 23, 2022

Last Modified

February 2, 2023

🔗 CVE IDs covered (1)

CVE-2022-4689 →

📋 Description

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.

🎯 Affected products1

go/github.com/usememos/memos:< 0.9.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-4689
https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3
https://github.com/usememos/memos/pull/831
https://github.com/advisories/GHSA-w57v-6xp4-rm2v