-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | < 0.9.0 | 0.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing Secure attribute in session cookies. The key evidence is in the commit diff for server/acl.go where the Secure: true attribute was added to the cookie configuration. The setUserSession function was creating cookies with HttpOnly but without Secure flag prior to the patch. This matches CWE-614's description of cookies missing Secure attribute in HTTPS sessions. Other changes in the commit relate to profile customization and input validation, but the core vulnerability is clearly in the session cookie configuration function.
GoGoOngoing coverage of React2Shell