GHSA-qcw2-492v-57xj

ghsaUSosv

usememos/memos missing Secure cookie attribute

view advisory published 2022-12-23Licence: CC-BY-4.0

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-4683US	medium6.5OT elevated	0.40% (34th)	—	2022-12-23
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.

references

External citations — patches, advisories, analysis.

https://github.com/usememos/memosPACKAGE
https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2eWEB
https://huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6efWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-4683ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan