CVE-2020-24327

Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.

Score

CVSS 3.1 5.3 Medium

Status

Modified - cve@mitre.org

Published

2021-09-23

Last modified

2024-08-04

Weaknesses

CWE-918

Affected products

• Discourse (Discourse)

References

• https://github.com/discourse/discourse/pull/10509
• https://github.com/purple-WL/Discourse-sending-email-function-exist-Server-side-request-forgery-SSRF-/issues/1