-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Session cookies were created without SameSite=Strict, allowing them to be sent in cross-site requests. This is evident in the setUserSession function's cookie configuration before the fix. 2) The server didn't implement CSRF token validation middleware in its initialization (NewServer function), leaving all endpoints unprotected. The fix explicitly added both SameSite cookie attributes and CSRF middleware, confirming these were the missing protections.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.9.0 |
A Semantic Attack on Google Gemini - Read the Latest Research