CVE-2023-0109 — MEDIUM (5.4)

Vulnerability Description

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Usememos	Memos	0.9.1

Related Weaknesses (CWE)

CWE-79

References

https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9Patch
https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6eExploitThird Party Advisory

FAQ

What is CVE-2023-0109?

CVE-2023-0109 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and re...

How severe is CVE-2023-0109?

CVE-2023-0109 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-0109?

Check the references section above for vendor advisories and patch information. Affected products include: Usememos Memos.