Discourse SSRF vulnerability in Embedding (CVE-2023-47121)

Summary

Discourse SSRF vulnerability in Embedding

Original description

The description as published by the source.

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches. As a workaround, disable the Embedding feature.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]

References

advisory github.com
patch github.com
patch github.com
web nvd.nist.gov