Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
References
Link | Resource |
---|---|
https://github.com/discourse/discourse/pull/10509 | Exploit Patch Third Party Advisory |
https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 | Exploit Third Party Advisory |
https://github.com/discourse/discourse/pull/10509 | Exploit Patch Third Party Advisory |
https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:14
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/discourse/discourse/pull/10509 - Exploit, Patch, Third Party Advisory | |
References | () https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 - Exploit, Third Party Advisory |
Information
Published : 2021-09-23 18:15
Updated : 2024-11-21 05:14
NVD link : CVE-2020-24327
Mitre link : CVE-2020-24327
CVE.ORG link : CVE-2020-24327
JSON object : View
Products Affected
discourse
- discourse
CWE
CWE-918
Server-Side Request Forgery (SSRF)