CVE-2024-37157

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No known workarounds are available.

• CWE-918
• CWE-918

• https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6ePatch
• https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68Third Party Advisory
• https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6ePatch
• https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68Third Party Advisory

Published

Jul 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37151Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-37152Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-37153Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…7.5
• CVE-2024-37154Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…5.3
• CVE-2024-37155OpenCTI is an open source platform allowing organizations to…8.2
• CVE-2024-37156The SuluFormBundle adds support for creating dynamic forms i…6.1
• CVE-2024-37158Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…8.1
• CVE-2024-37159Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…6.5
• CVE-2024-3716A flaw was found in foreman-installer when puppet-candlepin …6.2
• CVE-2024-37160Formwork is a flat file-based Content Management System (CMS…4.8
• CVE-2024-37161MeterSphere is an open source continuous testing platform. P…6.1
• CVE-2024-37162zsa is a library for building typesafe server actions in Nex…5.3