Description
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/discourse/discourse/security/advisories/GHSA-hp24-94qf-8cgc
Patch x_refsource_misc
https://github.com/discourse/discourse/commit/24cca10da731734af4e9748de99a508d586e59f1
Scores
CVSS v3
3.4
EPSS
0.0040
EPSS Percentile
60.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (3)
discourse/discourse
3.2.0 beta1 (2 CPE variants)
discourse/discourse
< 3.1.3
discourse/discourse
< 3.2.0
Published
Nov 10, 2023
Tracked Since
Feb 18, 2026