CVE-2023-28112

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta` branches versions 3.1.0.beta2 and prior. This issue is patched in version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.

• CWE-918

• https://github.com/discourse/discourse/commit/39c2f63b35d90ebaf67b9604cf1d424e5984203cPatch
• https://github.com/discourse/discourse/pull/20710Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-9897-x229-55ghVendor Advisory
• https://github.com/discourse/discourse/commit/39c2f63b35d90ebaf67b9604cf1d424e5984203cPatch
• https://github.com/discourse/discourse/pull/20710Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-9897-x229-55ghVendor Advisory

Published

Mar 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28107Discourse is an open-source discussion platform. Prior to ve…4.9
• CVE-2023-28108Pimcore is an open source data and experience management pla…7.8
• CVE-2023-28109Play With Docker is a browser-based Docker playground. Versi…6.5
• CVE-2023-2811The AI ChatBot WordPress plugin before 4.5.6 does not saniti…4.8
• CVE-2023-28110Jumpserver is a popular open source bastion host, and Koko i…9.9
• CVE-2023-28111Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2023-28113russh is a Rust SSH client and server library. Starting in v…5.9
• CVE-2023-28114`cilium-cli` is the command line interface to install, manag…4.1
• CVE-2023-28115Snappy is a PHP library allowing thumbnail, snapshot or PDF …9.8
• CVE-2023-28116Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2023-28117Sentry SDK is the official Python SDK for Sentry, real-time …6.5
• CVE-2023-28118kaml provides YAML support for kotlinx.serialization. Prior …7.5