CVE - CVE-2023-0109

CVE-ID
CVE-2023-0109	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c URL:https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c MISC:https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e URL:https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e
Assigning CNA
Protect AI
Date Record Created
20230107	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230107)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)