CVE-2023-0109
published 2024-11-15CVE-2023-0109: A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.44%
35.0th percentile
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | usememos_memos | >= 0 < 0.10.0 | 0.10.0 |
| usememos | memos | — | — |
| usememos | usememos_memos | >= unspecified < 0.10.0 | 0.10.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Stored XSS using two files in usememos/memos in github.com/usememos/memos
osv·2024-11-19
CVE-2023-0109 Stored XSS using two files in usememos/memos in github.com/usememos/memos
Stored XSS using two files in usememos/memos in github.com/usememos/memos
Stored XSS using two files in usememos/memos in github.com/usememos/memos
GHSA
Stored XSS using two files in usememos/memos
ghsa·2024-11-15
CVE-2023-0109 [MEDIUM] CWE-79 Stored XSS using two files in usememos/memos
Stored XSS using two files in usememos/memos
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
OSV
Stored XSS using two files in usememos/memos
osv·2024-11-15
CVE-2023-0109 [MEDIUM] Stored XSS using two files in usememos/memos
Stored XSS using two files in usememos/memos
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-15
Published