GHSA-6fcf-g3mp-xj2xMediumCVSS 5.8

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

Published
August 5, 2024
Last Modified
August 5, 2024

🔗 CVE IDs covered (1)

CVE-2024-29028 →

📋 Description

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

🎯 Affected products1

  • go/github.com/usememos/memos:< 0.16.1

🔗 References (4)