Lucene search

@huntrdevCVE-2022-4687

HistoryDec 23, 2022 - 12:15 p.m.

CVE-2022-4687

2022-12-2312:15:11

CWE-269

CWE-648

@huntrdev

web.nvd.nist.gov

cve-2022-4687

github repository

nvd

api misuse

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

30.8%

JSON

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.

Affected configurations

Nvd

Node

usememosmemosRange<0.9.0

VendorProductVersionCPE
usememosmemos*cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
usememos	memos	*	cpe:2.3:a:usememos:memos::::::::

CNA Affected

[
  {
    "vendor": "usememos",
    "product": "usememos/memos",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "0.9.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9

huntr.dev/bounties/b908377f-a61b-432c-8e6a-c7498da69788

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2022-4687