CVE-2024-29029

Katalog CVE

CVSS 6.1 · Medium EPSS 1,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada usememos memos. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.

Rincian

Terbit di NVD

19 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5 patch
• https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/ exploit · advisory pihak ketiga
• https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/http_getter.go#L29 product