Vulnerability · Published Nov 15, 2024 · Assigned by @huntr_ai
CVE-2023-0109Stored XSS in usememos/memos
Critical 9.8
In plain English
A critical-severity cross-site scripting in usememos/memos from usememos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/usememos/memos | 0.10.0 | GHSA-5r2g-59px-3q9w |
| Go | github.com/usememos/memos | 0.10.0 | GO-2024-3274 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| usememos | usememos/memos | unspecified – before 0.10.0 |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H