6.5

CVE-2022-4683

Exploit

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Usememos ≫ Memos Version < 0.9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.292
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security@huntr.dev 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2e
Patch
Third Party Advisory
https://huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6ef
Patch
Third Party Advisory
Exploit
Issue Tracking