-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.9.0 | 0.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Session cookies without SameSite restrictions (CWE-941) allowed cross-origin transmission, and 2) Missing CSRF token validation enabled request forgery. The patch added SameSite:Strict to cookies in setUserSession() and introduced CSRF middleware in NewServer. These functions directly correspond to the attack vectors described in CWE-941 and the CVE's CSRF focus.