CVE-2025-22952
Published: 27 February 2025
Description
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
Security Summary
CVE-2025-22952 is a Server-Side Request Forgery (SSRF) vulnerability in Elestio Memos version 0.23.0, stemming from insufficient validation of user-supplied URLs. This issue, classified under CWE-918, was published on 2025-02-27 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high impacts across confidentiality, integrity, and availability.
Unauthenticated attackers with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation enables SSRF attacks, allowing attackers to manipulate the server into making unauthorized requests on their behalf.
The Memos GitHub repository documents the issue in #4413 and provides a fix via pull request #4428. Security practitioners should consult the Elestio open-source Memos page and the official Memos repository for patching details and updated versions to mitigate the risk.
Details
- CWE(s)