CVE-2023-28111

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse's server-side request forgery (SSRF) protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the latest beta and tests-passed version of Discourse. version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.

• CWE-918

• https://github.com/discourse/discourse/commit/fd16eade7fcc6bba4b71e71106a2eb13cdfdae4aPatch
• https://github.com/discourse/discourse/pull/20710Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-26h3-8ww8-v5fcVendor Advisory
• https://github.com/discourse/discourse/commit/fd16eade7fcc6bba4b71e71106a2eb13cdfdae4aPatch
• https://github.com/discourse/discourse/pull/20710Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-26h3-8ww8-v5fcVendor Advisory

Published

Mar 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28106Pimcore is an open source data and experience management pla…4.8
• CVE-2023-28107Discourse is an open-source discussion platform. Prior to ve…4.9
• CVE-2023-28108Pimcore is an open source data and experience management pla…7.8
• CVE-2023-28109Play With Docker is a browser-based Docker playground. Versi…6.5
• CVE-2023-2811The AI ChatBot WordPress plugin before 4.5.6 does not saniti…4.8
• CVE-2023-28110Jumpserver is a popular open source bastion host, and Koko i…9.9
• CVE-2023-28112Discourse is an open-source discussion platform. Prior to ve…8.1
• CVE-2023-28113russh is a Rust SSH client and server library. Starting in v…5.9
• CVE-2023-28114`cilium-cli` is the command line interface to install, manag…4.1
• CVE-2023-28115Snappy is a PHP library allowing thumbnail, snapshot or PDF …9.8
• CVE-2023-28116Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2023-28117Sentry SDK is the official Python SDK for Sentry, real-time …6.5