CVE-2024-41659: GHSL-2024-034: Privilege escalation in memos - CVE-2024-41659
A CORS misconfiguration exists in memos where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.
Other sources
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41659?
CVE-2024-41659 is classified as a high severity vulnerability due to the potential for cross-origin resource sharing (CORS) issues.
How do I fix CVE-2024-41659?
To fix CVE-2024-41659, upgrade your memos installation to version 0.21.0 or later where the CORS misconfiguration has been resolved.
What impact does CVE-2024-41659 have on my application?
CVE-2024-41659 may allow malicious websites to make unauthorized cross-origin requests, potentially compromising user data and privacy.
Which versions of memos are affected by CVE-2024-41659?
Versions of memos prior to 0.21.0 are affected by CVE-2024-41659, specifically 0.20.1 and earlier.
Is CVE-2024-41659 related to other vulnerabilities in the memos application?
CVE-2024-41659 is a specific vulnerability that focuses on CORS misconfiguration and is independent of other vulnerabilities unless otherwise stated in documentation.