CVE-2024-41659 - CVE House
Back to Database
Status published High CVE-2024-41659

GHSL-2024-034: memos CORS Misconfiguration in server.go

Vulnerability Description

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41659

Credits & Attribution

No credits recorded in the NVD database.

References

More from usememos

View All →
CVE-2024-29030
memos vulnerable to an SSRF in /api/resource
Medium 5.8
CVE-2024-29029
memos vulnerable to an SSRF in /o/get/image
Medium 6.1
CVE-2024-29028
memos vulnerable to an SSRF in /o/get/httpmeta
Medium 5.8
CVE-2024-21635
Memos Access Tokens Stay Valid after User Password Change
High 7.1
CVE-2023-5036
Cross-Site Request Forgery (CSRF) in usememos/memos
High 7.3

Affected Vendor

Affected Software

memos
Vulnerable Versions:
< 0.21.0

Timeline

Official Publish: August 20th, 2024
Last Modified: January 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-942

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.