CVE-2024-29030

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
GitHub_MCNA
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
VendorProductVersion
usememosmemos
0.13.2 ≤
𝑥
< 0.22.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/resource.go#L83
https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5
https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/resource.go#L83
https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5
https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/