CVE-2024-41659

Name of the Vulnerable Software and Affected Versions memos versions 0.20.1 and earlier

Description A CORS misconfiguration exists in memos where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.

Recommendations For memos versions 0.20.1 and earlier, update to version 0.21.0 to fix the CORS misconfiguration vulnerability. As a temporary workaround, consider restricting access to sensitive information and privileged actions to minimize the risk of exploitation.