GHSA-6fcf-g3mp-xj2x

ghsaUSosv

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

view advisory published 2024-08-05Licence: CC-BY-4.0

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-29028US	medium5.3	1.05% (64th)	—	2024-04-19
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the i…

references

External citations — patches, advisories, analysis.

https://github.com/usememos/memosPACKAGE
https://github.com/usememos/memos/commit/6ffc09d86a1302c384ef085aa70c7bddb3ce7ba9WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-29028ADVISORY
https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memosADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan