search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
564 stars 61 forks source link

x/vulndb: potential Go vuln in github.com/usememos/memos: GHSA-5r2g-59px-3q9w #3274

Closed GoVulnBot closed 6 days ago

GoVulnBot commented 1 week ago

Advisory GHSA-5r2g-59px-3q9w references a vulnerability in the following Go modules:

Module
github.com/usememos/memos

Description: A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/usememos/memos
      versions:
        - fixed: 0.10.0
      vulnerable_at: 0.9.1
summary: Stored XSS using two files in usememos/memos in github.com/usememos/memos
cves:
    - CVE-2023-0109
ghsas:
    - GHSA-5r2g-59px-3q9w
references:
    - advisory: https://github.com/advisories/GHSA-5r2g-59px-3q9w
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-0109
    - fix: https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
    - web: https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e
source:
    id: GHSA-5r2g-59px-3q9w
    created: 2024-11-15T21:01:22.939142186Z
review_status: UNREVIEWED
gopherbot commented 6 days ago

Change https://go.dev/cl/629356 mentions this issue: data/reports: add 9 unreviewed reports