~ / search / GHSA-p4fx-qf2h-jpmj

GHSA-p4fx-qf2h-jpmj

memos CORS Misconfiguration in server.go (GHSL-2024-034)

Source: GitHub Advisory Database (reviewed) High CVE-2024-41659

Packages

EcosystemPackageAffectedFixed in
Go github.com/usememos/memos < 0.21.0 0.21.0

Details

As written in the advisory (Markdown source, shown as plain text).

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.

References

External links from the advisory. They lead to third-party sites.