PT-2024-29488 · Memos · Memos

Kevin Stubbings + 1 · Published 2024-08-20 · Updated 2024-08-30 · CVE-2024-41659

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions memos versions 0.20.1 and earlier

Description A CORS misconfiguration exists in memos where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.

Recommendations For memos versions 0.20.1 and earlier, update to version 0.21.0 to fix the CORS misconfiguration vulnerability. As a temporary workaround, consider restricting access to sensitive information and privileged actions to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2024-41659

GHSA-P4FX-QF2H-JPMJ

GO-2024-3088

Affected Products

Memos

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41659.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-034_memos · Exploit
• https://github.com/usememos/memos/commit/8101a5e0b162044c16385bee4f12a4a653d050b9 · Patch
• https://osv.dev/vulnerability/GHSA-p4fx-qf2h-jpmj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41659 · Security Note
• https://osv.dev/vulnerability/GO-2024-3088 · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://github.com/usememos/memos/blob/v0.20.1/server/server.go#L163 · Note
• https://github.com/advisories/GHSA-p4fx-qf2h-jpmj · Note
• https://twitter.com/CVEnew/status/1825991805894070595 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1826030017035260272 · Twitter Post
• https://t.me/cvenotify/91759 · Telegram Post
• https://t.me/cvedetector/3684 · Telegram Post