Description
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.
Published: 2024-04-19
Score: 5.8 Medium
EPSS: 6.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2512 memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.
Github GHSA Github GHSA GHSA-6fcf-g3mp-xj2x memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00064}

 epss

{'score': 0.00087}

Mon, 07 Jul 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Usememos
Usememos memos
CPEs cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*
Vendors & Products Usememos
Usememos memos

Subscriptions

Usememos Memos
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-08-07T17:47:02.151Z

Reserved: 2024-03-14T16:59:47.612Z

Link: CVE-2024-29028

cve-icon Vulnrichment

Updated: 2024-08-02T01:03:51.620Z

cve-icon NVD

Status : Analyzed

Published: 2024-04-19T15:15:50.243

Modified: 2025-07-07T16:03:50.147

Link: CVE-2024-29028

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses