CVE-2025-22952

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://elest.io/open-source/memos
https://github.com/usememos/memos
https://github.com/usememos/memos/issues/4413
https://github.com/usememos/memos/pull/4428
https://github.com/usememos/memos/issues/4413
Configurations

No configuration.

History

03 Mar 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/usememos/memos/issues/4413 - () https://github.com/usememos/memos/issues/4413 -
CWE CWE-918
Summary
  • (es) elestio memos v0.23.0 es vulnerable a Server-Side Request Forgery (SSRF) debido a una validación insuficiente de las URL proporcionadas por el usuario, lo que puede explotarse para realizar ataques SSRF.

27 Feb 2025, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 20:16

Updated : 2025-03-03 16:15

NVD link : CVE-2025-22952

Mitre link : CVE-2025-22952

CVE.ORG link : CVE-2025-22952

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)