search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
562 stars 61 forks source link

x/vulndb: potential Go vuln in github.com/usememos/memos: GHSA-p4fx-qf2h-jpmj #3088

Closed GoVulnBot closed 2 months ago

GoVulnBot commented 2 months ago

Advisory GHSA-p4fx-qf2h-jpmj references a vulnerability in the following Go modules:

Module
github.com/usememos/memos

Description: memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/usememos/memos
      versions:
        - fixed: 0.21.0
      vulnerable_at: 0.20.1
summary: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos
cves:
    - CVE-2024-41659
ghsas:
    - GHSA-p4fx-qf2h-jpmj
references:
    - advisory: https://github.com/advisories/GHSA-p4fx-qf2h-jpmj
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-41659
    - fix: https://github.com/usememos/memos/commit/8101a5e0b162044c16385bee4f12a4a653d050b9
    - web: https://github.com/usememos/memos/blob/v0.20.1/server/server.go#L163
    - web: https://securitylab.github.com/advisories/GHSL-2024-034_memos
source:
    id: GHSA-p4fx-qf2h-jpmj
    created: 2024-08-22T18:01:14.483883165Z
review_status: UNREVIEWED
gopherbot commented 2 months ago

Change https://go.dev/cl/609141 mentions this issue: data/reports: add 21 unreviewed reports