CVE-2023-47121

Katalog CVE

CVSS 9.8 · Critical EPSS 0,69%

Kerentanan Server-Side Request Forgery (SSRF) pada discourse. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature.

Rincian

Terbit di NVD

10 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-hp24-94qf-8cgc advisory vendor
• https://github.com/discourse/discourse/commit/24cca10da731734af4e9748de99a508d586e59f1 patch
• https://github.com/discourse/discourse/commit/5f20748e402223b265e6fee381472c14e2604da6 patch