CVE-2024-21635

{"id": "CVE-2024-21635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-21635", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T16:08:26.410667Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "usememos", "product": "memos", "versions": [{"status": "affected", "version": "<= 0.18.1"}]}]}], "published": "2025-11-14T15:15:48.840", "references": [{"url": "https://github.com/usememos/memos/security/advisories/GHSA-mr34-8733-grr2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/usememos/memos/security/advisories/GHSA-mr34-8733-grr2", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update their password. In versions up to and including 0.18.1, though, the bad actor will still have access to their account because the bad actor's Access Token stays on the list as a valid token. The user will have to manually delete the bad actor's Access Token to secure their account. The list of Access Tokens has a generic Description which makes it hard to pinpoint a bad actor in a list of Access Tokens. A known patched version of Memos isn't available. To improve Memos security, all Access Tokens will need to be revoked when a user changes their password. This removes the session for all the user's devices and prompts the user to log in again. One can treat the old Access Tokens as \"invalid\" because those Access Tokens were created with the older password."}, {"lang": "es", "value": "Memos es un servicio de toma de notas ligero que prioriza la privacidad y utiliza Tokens de Acceso para autenticar el acceso a la aplicaci\u00f3n. Cuando un usuario cambia su contrase\u00f1a, la lista existente de Tokens de Acceso permanece v\u00e1lida en lugar de caducar. Si un usuario descubre que su cuenta ha sido comprometida, puede actualizar su contrase\u00f1a. Sin embargo, en versiones hasta la 0.18.1 inclusive, el actor malicioso seguir\u00e1 teniendo acceso a su cuenta porque el Token de Acceso del actor malicioso permanece en la lista como un token v\u00e1lido. El usuario tendr\u00e1 que eliminar manualmente el Token de Acceso del actor malicioso para asegurar su cuenta. La lista de Tokens de Acceso tiene una Descripci\u00f3n gen\u00e9rica, lo que dificulta identificar a un actor malicioso en una lista de Tokens de Acceso. Una versi\u00f3n parcheada conocida de Memos no est\u00e1 disponible. Para mejorar la seguridad de Memos, todos los Tokens de Acceso deber\u00e1n ser revocados cuando un usuario cambie su contrase\u00f1a. Esto elimina la sesi\u00f3n para todos los dispositivos del usuario y solicita al usuario que inicie sesi\u00f3n de nuevo. Se pueden tratar los Tokens de Acceso antiguos como 'inv\u00e1lidos' porque esos Tokens de Acceso fueron creados con la contrase\u00f1a anterior."}], "lastModified": "2026-10-02T00:10:00.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D1EFD1-55BD-42B2-A420-EF7C1F9453CA", "versionEndIncluding": "0.18.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}