PT-2021-11026 · Discourse · Discourse

Purple-Wl · Published 2021-09-23 · Updated 2024-03-06 · CVE-2020-24327

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.3.2 through 2.6

Description: A Server Side Request Forgery (SSRF) issue exists via the email function. When writing an email in an editor, it is possible to upload pictures from remote websites.

Recommendations: For versions 2.3.2 through 2.6, as a temporary workaround, consider disabling the email function until a patch is available. Restrict access to the email editor to minimize the risk of exploitation. Avoid using the email function to upload pictures from remote websites until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-DISCOURSE-2020-24327

CVE-2020-24327

Affected Products

Discourse

References · 5

• 🔥 https://github.com/discourse/discourse/pull/10509 · Exploit
• 🔥❌ https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-24327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24327 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2020-24327 · Vendor Advisory