CVE-2024-41659: falha de alta gravidade em usememos memos
GHSL-2024-034: memos CORS Misconfiguration in server.go
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.6%
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
usememos · memosCVEs relacionadas — usememos memos
No mesmo produto, das mais perigosas para as menos.
CVE-2024-29030MEDIUMmemos vulnerable to an SSRF in /api/resourceEPSS 1.1%CVE-2024-29029MEDIUMmemos vulnerable to an SSRF in /o/get/imageEPSS 1.1%CVE-2024-29028MEDIUMmemos vulnerable to an SSRF in /o/get/httpmetaEPSS 1.0%CVE-2026-84203HIGHMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeEPSS 0.4%CVE-2026-82476MEDIUMMemos through 0.30.0 SSRF via Omitted CGNAT Address RangeEPSS 0.4%CVE-2026-71271HIGHMemos Webhook SSRF via 0.0.0.0 Reserved-IP BypassEPSS 0.3%