CVE-2024-29028CWE-918

memos vulnerable to an SSRF in /o/get/httpmeta

Medium · published April 19, 2024

CVSS v3.1
5.8
EPSS
1%
Percentile
63.9
In the wild
Unconfirmed
What it is

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01049 · 63.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-04-19T15:14Z
EPSS history
Timeline
  • 19 APR 15:14Z
    memos vulnerable to an SSRF in /o/get/httpmeta
    cvelistv5