CVE-2023-0109CWE-79

Stored XSS in usememos/memos

Critical · published November 15, 2024

CVSS v3.0
9.8
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-15T10:57Z
EPSS history
Timeline
  • 15 NOV 10:57Z
    Stored XSS in usememos/memos
    cvelistv5