CVE-2023-0109: Stored XSS in usememos/memos
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0109?
CVE-2023-0109 has been rated with a moderate severity due to its stored cross-site scripting (XSS) nature.
How do I fix CVE-2023-0109?
To mitigate CVE-2023-0109, upgrade the usememos/memos software to version 0.10.0 or later.
What type of attack does CVE-2023-0109 enable?
CVE-2023-0109 enables attackers to execute malicious JavaScript in the context of user sessions through stored XSS.
Which version of usememos/memos is affected by CVE-2023-0109?
CVE-2023-0109 specifically affects usememos/memos version 0.9.1.
Is user data at risk with CVE-2023-0109?
Yes, CVE-2023-0109 puts user data at risk by potentially allowing attackers to steal cookies and session tokens via XSS.