search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
562 stars 61 forks source link

x/vulndb: potential Go vuln in github.com/usememos/memos: GHSA-2g7r-9xq5-c6hv #2065

Closed GoVulnBot closed 1 year ago

GoVulnBot commented 1 year ago

In GitHub Security Advisory GHSA-2g7r-9xq5-c6hv, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/usememos/memos 0.15.1 < 0.15.1

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/usememos/memos
      versions:
        - fixed: 0.15.1
      vulnerable_at: 0.15.0
      packages:
        - package: github.com/usememos/memos
summary: Cross-Site Request Forgery (CSRF) in usememos/memos
description: |-
    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to
    0.15.1.
cves:
    - CVE-2023-5036
ghsas:
    - GHSA-2g7r-9xq5-c6hv
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-5036
    - fix: https://github.com/usememos/memos/commit/97b434722cf0abe3cfcad5ac9e3d520233bf1536
    - web: https://huntr.dev/bounties/46881df7-eb41-4ce2-a78f-82de9bc4fc2d
    - advisory: https://github.com/advisories/GHSA-2g7r-9xq5-c6hv
gopherbot commented 1 year ago

Change https://go.dev/cl/529256 mentions this issue: data/excluded: batch add 3 excluded reports

gopherbot commented 5 months ago

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports

gopherbot commented 2 months ago

Change https://go.dev/cl/606791 mentions this issue: data/reports: unexclude 20 reports (11)