Lucene search

@huntrdevCVE-2022-4850

HistoryDec 29, 2022 - 6:15 p.m.

CVE-2022-4850

2022-12-2918:15:10

CWE-352

@huntrdev

web.nvd.nist.gov

cve-2022-4850

cross-site request forgery

csrf

github

repository

usememos

memos

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.7%

JSON

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

Affected configurations

Nvd

Node

usememosmemosRange<0.9.1

VendorProductVersionCPE
usememosmemos*cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
usememos	memos	*	cpe:2.3:a:usememos:memos::::::::

CNA Affected

[
  {
    "vendor": "usememos",
    "product": "usememos/memos",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "0.9.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948

huntr.dev/bounties/46dc4728-eacc-43f5-9831-c203fdbcc346

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.7%

JSON

Related for CVE-2022-4850