CVE-2023-0109

Description

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

Reserved 2023-01-07 | Published 2024-11-15 | Updated 2024-11-15 | Assigner @huntr_ai

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version before 0.10.0
affected

References

huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e

github.com/...ommit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c

cve.org (CVE-2023-0109)

nvd.nist.gov (CVE-2023-0109)

Download JSON