CVEvulnerability
CVE-2020-24327
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-09-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-918
Description
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
Affected configurations
• discourse discourse 2.3.2
• discourse discourse 2.6.0
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/discourse/discourse/pull/10509 Exploit, Patch, Third Party Advisory
- https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 Exploit, Third Party Advisory
- https://github.com/discourse/discourse/pull/10509 Exploit, Patch, Third Party Advisory
- https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 Exploit, Third Party Advisory