Lucene search

@huntrdevCVE-2022-4686

HistoryDec 23, 2022 - 12:15 p.m.

CVE-2022-4686

2022-12-2312:15:11

CWE-639

@huntrdev

web.nvd.nist.gov

cve-2022-4686

authorization bypass

github repository

usememos

memos

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.

Affected configurations

Nvd

Node

usememosmemosRange<0.9.0

VendorProductVersionCPE
usememosmemos*cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
usememos	memos	*	cpe:2.3:a:usememos:memos::::::::

CNA Affected

[
  {
    "vendor": "usememos",
    "product": "usememos/memos",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "0.9.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9

huntr.dev/bounties/caa0b22c-501f-44eb-af65-65c315cd1637

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

Related for CVE-2022-4686