Discourse vulnerable to Server-Side Request Forgery via FastImage
Summary
Discourse vulnerable to Server-Side Request Forgery via FastImage
Original description
The description as published by the source.
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory github.com
- patch github.com
- patch github.com
- web nvd.nist.gov