CVE-2024-29029

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.

• CWE-79
• CWE-918
• CWE-79
• CWE-918

• https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/http_getter.go#L29Product
• https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5Patch
• https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/Exploit, Third Party Advisory
• https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/http_getter.go#L29Product
• https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5Patch
• https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/Exploit, Third Party Advisory

Published

Apr 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29023Xibo is an Open Source Digital Signage platform with a web c…7.2
• CVE-2024-29024JumpServer is an open source bastion host and an operation a…5.3
• CVE-2024-29025Netty is an asynchronous event-driven network application fr…5.3
• CVE-2024-29026Owncast is an open source, self-hosted, decentralized, singl…9.1
• CVE-2024-29027Parse Server is an open source backend that can be deployed …9
• CVE-2024-29028memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-2903A vulnerability was found in Tenda AC7 15.03.06.44. It has b…8.8
• CVE-2024-29030memos is a privacy-first, lightweight note-taking service. I…5.3
• CVE-2024-29031Meshery is an open source, cloud native manager that enables…7.5
• CVE-2024-29032Qiskit IBM Runtime is an environment that streamlines quantu…7.8
• CVE-2024-29033OAuthenticator provides plugins for JupyterHub to use common…9.1
• CVE-2024-29034CarrierWave is a solution for file uploads for Rails, Sinatr…6.1