CVE-2023-0109criticalCWE-79

CVE-2023-0109: fallo crítico en usememos/memos

Stored XSS in usememos/memos

Publicada el

Seguir esta CVE+ Monitorear usememos/memos+ Monitorear github.com/usememos/memos

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.5%
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
usememos · usememos/memos
CVEs relacionadas — usememos/memos

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4696CRITICALImproper Access Control in usememos/memosEPSS 1.1%CVE-2022-4866CRITICALCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.1%CVE-2022-4865HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.1%CVE-2022-4809HIGHImproper Access Control in usememos/memosEPSS 1.0%CVE-2023-4698HIGHImproper Input Validation in usememos/memosEPSS 0.9%CVE-2022-4803HIGHAuthorization Bypass Through User-Controlled Key in usememos/memosEPSS 0.9%