CVE-2024-41659

Katalog CVE

CVSS 8.1 · High EPSS 0,64%

Kerentanan Permissive Cross-domain Security Policy with Untrusted Domains pada usememos memos. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.

Rincian

Terbit di NVD

20 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/usememos/memos/commit/8101a5e0b162044c16385bee4f12a4a653d050b9 patch
• https://securitylab.github.com/advisories/GHSL-2024-034_memos/ exploit · advisory pihak ketiga
• https://github.com/usememos/memos/blob/v0.20.1/server/server.go#L163 product