BIT-discourse-2020-24327

vendorUSosv

view advisory published 2024-03-06Licence: per source

Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-24327US	medium5.3	1.06% (64th)	—	2021-09-23
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote web…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/pull/10509ADVISORY
https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-24327WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan