CVE-2024-41659: usememos memos

Vulnerability summary

CVE-2024-41659 is a high (CVSS 8.1) vulnerability in usememos memos. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-08-2024
   PublishedVulnerability first disclosed.
2. 09-01-2025
   Last modifiedVulnerability information updated.

Description

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.

• CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.