UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28112

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta`…

Severity
High 8.1
Published
17 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.1.0
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.1.0
  • Every version up to 3.1.0
  • Version 3.1.0-beta1
  • Version 3.1.0-beta2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28112
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28112