CVE-2024-29029: falha de média gravidade em usememos memos
memos vulnerable to an SSRF in /o/get/image
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
50Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 6.1epss 1.1%
da publicação à arma
Publicada no NVD19 de abr.
VulnCheck+524d
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
usememos · memosCVEs relacionadas — usememos memos
No mesmo produto, das mais perigosas para as menos.
CVE-2024-29030MEDIUMmemos vulnerable to an SSRF in /api/resourceEPSS 1.1%CVE-2024-29028MEDIUMmemos vulnerable to an SSRF in /o/get/httpmetaEPSS 1.0%CVE-2024-41659HIGHGHSL-2024-034: memos CORS Misconfiguration in server.goEPSS 0.6%CVE-2026-84203HIGHMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeEPSS 0.4%CVE-2026-82476MEDIUMMemos through 0.30.0 SSRF via Omitted CGNAT Address RangeEPSS 0.4%CVE-2026-71271HIGHMemos Webhook SSRF via 0.0.0.0 Reserved-IP BypassEPSS 0.3%