High severity · published Mar 17, 2023
CVE-2023-28112
Discourse is an open-source discussion platform
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta` branches versions 3.1.0.beta2 and prior. This issue is patched in version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Discourse · Discourse
before 3.1.0; through 3.1.0; 3.1.0; 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28112
Patch
https://github.com/discourse/discourse/commit/39c2f63b35d90ebaf67b9604cf1d424e5984203c
Patch
https://github.com/discourse/discourse/pull/20710
Vendor Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-9897-x229-55gh
More from Discourse
9.9
CVE-2025-68662
FinalDestination hostname matching allows SSRF protection bypass
9.8
CVE-2025-53102
Discourse is an open-source community discussion platform
9.8
CVE-2025-48877
Discourse is an open-source discussion platform
9.8
CVE-2023-47121
Discourse is an open source platform for community discussion
9.8
CVE-2021-41163
Discourse is an open source platform for community discussion